CVE-2024-24561: Vyper's bounds check on built-in `slice()` function can be overflowed

Background

Vyper is an open-source programming language used for writing smart contracts on the Ethereum blockchain. It is designed to be secure, simple, and auditable. The slice() function in Vyper is used to extract a portion of a byte array or string. However, a vulnerability has been discovered in the bounds check of the slice() function, which can be overflowed when non-literal arguments are used for the start or length variables. This vulnerability can lead to out-of-bounds (OOB) access to storage, memory, or calldata addresses, as well as corruption of the length slot of the respective array.

Vulnerability Detail

The bounds check for the slice() function in Vyper does not properly account for the possibility of overflow when non-literal arguments are used for the start or length variables. This allows an attacker to manipulate the start or length values in a way that overflows the bounds check and enables OOB access or corruption of the length slot. An attacker can exploit this vulnerability to access unrelated storage slots, return unexpected values from storage, or corrupt the length slot of an array. The impact of this vulnerability can range from unauthorized access to sensitive data to the disruption of contract functionality.

pip install --upgrade "vyper==0.4.3"

pip install --upgrade "vyper==0.4.0"

Workaround

As a temporary workaround, developers can manually perform bounds checks before calling the slice() function. By checking the start and length values against the maximum allowed index for the array, developers can prevent potential overflow and mitigate the risk of OOB access or corruption. Here's an example of how to implement the workaround in Vyper:

if start + length > array_length:
    revert("Slice out of bounds")
else:
    sliced_array = slice(array, start, length)

Conclusion

The vulnerability in Vyper's slice() function can be exploited to achieve OOB access or corruption of the length slot. It is crucial for the Vyper development team to address this vulnerability by updating the bounds checks and thoroughly testing the code. Developers can also implement a temporary workaround by manually performing bounds checks. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for vyper →

FAQ