CVE-2024-24559

published 2024-02-05

CVE-2024-24559: Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the…

Priority P4 27 medium 5.3 CVSS 3.1

AV N AC L PR N UI N S U C L I N A N

Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writing the `IR` by hand (that is, it cannot be triggered from regular vyper code). `sha3_64` is used for retrieval in mappings. No flow that would cache the `key` was found so the issue shouldn't be possible to trigger when compiling the compiler-generated `IR`. This issue isn't triggered during normal compilation of vyper code so the impact is low. At the time of publication there is no patch available.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
vyperlang	vyper	<= 0.3.10	—
vyperlang	vyper	>= 0 < 0.4.0b1	0.4.0b1
vyperlang	vyper	>= 0 < 0.4.0	0.4.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-327