PT-2024-24740 · Vyper · Vyper

Charles-Cooper · Published 2024-04-25 · Updated 2025-01-02 · CVE-2024-32647

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vyper versions 0.3.10 and prior

Description Using the create from blueprint builtin can result in a double eval vulnerability when raw args=True and the args argument has side-effects. The build create IR function of the create from blueprint builtin doesn't cache the mentioned args argument to the stack, allowing it to be evaluated multiple times. No vulnerable production contracts were found, and double evaluation of side-effects should be easily discoverable in client tests, resulting in a low impact.

Recommendations For Vyper versions 0.3.10 and prior, as a temporary workaround, consider disabling the create from blueprint builtin with raw args=True until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2024-32647

GHSA-3WHQ-64Q2-QFJ6

PYSEC-2024-208

Affected Products

Vyper

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32647.json · Exploit
• https://github.com/vyperlang/vyper/security/advisories/GHSA-3whq-64q2-qfj6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32647 · Security Note
• https://osv.dev/vulnerability/GHSA-3whq-64q2-qfj6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32647 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-208 · Vendor Advisory
• https://github.com/vyperlang/vyper · Note
• https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-208.yaml · Note