CVE-2024-32646
published 2024-04-25CVE-2024-32646: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.45%
36.3th percentile
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the versions `<0.3.4` as `0.3.4` introduced the unique symbol fence. No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | < 0.4.0 | 0.4.0 |
| vyperlang | vyper | <= 0.3.10 | — |
| vyperlang | vyper | >= 0 < 0.4.0 | 0.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
vyper performs double eval of the slice start/length args in certain cases
ghsa·2024-04-25
CVE-2024-32646 [MEDIUM] CWE-20 vyper performs double eval of the slice start/length args in certain cases
vyper performs double eval of the slice start/length args in certain cases
### Summary
Using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `.code` and either the `start` or `length` arguments have side-effects.
A contract search was performed and no vulnerable contracts were found in production. Having side-effects in the start and length patterns is also an unusual pattern which is not that likely to show up in user code. It is also much harder (but not impossible!) to trigger the bug since `0.3.4` since the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).
### Details
It can be seen that the `_build_adhoc_slice_node` function of the `slice` builtin doesn't cache the mentioned
OSV
CVE-2024-32646: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine
osv·2024-04-25
CVE-2024-32646 CVE-2024-32646: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the versions `<0.3.4` as `0.3.4` introduced the unique symbol fence. No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.
OSV
vyper performs double eval of the slice start/length args in certain cases
osv·2024-04-25
CVE-2024-32646 [MEDIUM] vyper performs double eval of the slice start/length args in certain cases
vyper performs double eval of the slice start/length args in certain cases
### Summary
Using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `.code` and either the `start` or `length` arguments have side-effects.
A contract search was performed and no vulnerable contracts were found in production. Having side-effects in the start and length patterns is also an unusual pattern which is not that likely to show up in user code. It is also much harder (but not impossible!) to trigger the bug since `0.3.4` since the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).
### Details
It can be seen that the `_build_adhoc_slice_node` function of the `slice` builtin doesn't cache the mentioned
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-04-25
Published