CVE-2024-24559
Description
Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writing the `IR` by hand (that is, it cannot be triggered from regular vyper code). `sha3_64` is used for retrieval in mappings. No flow that would cache the `key` was found so the issue shouldn't be possible to trigger when compiling the compiler-generated `IR`. This issue isn't triggered during normal compilation of vyper code so the impact is low. At the time of publication there is no patch available.
How to fix
- vyper0.4.0, 0.4.0b1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vyperlang vyper | v ≤ 0.3.10 | — |
| vyperPyPI | v < 0.4.0, v < 0.4.0b1 | 0.4.0, 0.4.0b1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.