CVE-2024-32649 – vyper

Package

Manager: pip
Name: vyper
Vulnerable Version: >=0 <0.4.0

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00893 pctl0.74709

Details

vyper performs multiple eval of `sqrt()` argument built in ### Summary Using the `sqrt` builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914). A contract search was performed and no vulnerable contracts were found in production. ### Details It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack: https://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L2151 As such, it can be evaluated multiple times (instead of retrieving the value from the stack). ### PoC With at least Vyper version `0.2.15+commit.6e7dba7` the following contract: ```vyper c: uint256 @internal def some_decimal() -> decimal: self.c += 1 return 1.0 @external def foo() -> uint256: k: decimal = sqrt(self.some_decimal()) return self.c ``` passes the following test: ```solidity // SPDX-License-Identifier: MIT pragma solidity >=0.8.13; import "../../lib/ds-test/test.sol"; import "../../lib/utils/Console.sol"; import "../../lib/utils/VyperDeployer.sol"; import "../ITest.sol"; contract ConTest is DSTest { VyperDeployer vyperDeployer = new VyperDeployer(); ITest t; function setUp() public { t = ITest(vyperDeployer.deployContract("Test")); } function testFoo() public { uint256 val = t.foo(); console.log(val); assert (val == 4); } } ``` ### Patches Patched in https://github.com/vyperlang/vyper/pull/3976. ### Impact No vulnerable production contracts were found.

Metadata

Created: 2024-04-25T19:50:16Z
Modified: 2025-01-21T17:53:44Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-5jrj-52x8-m64h/GHSA-5jrj-52x8-m64h.json
CWE IDs: ["CWE-95"]
Alternative ID: GHSA-5jrj-52x8-m64h
Finding: F004
Auto approve: 1