CVE-2024-24563: Vyper array negative index vulnerability in vyper
Summary
CVE-2024-24563: Vyper negative array index bounds checks. Affects vyper versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is an open-source programming language for Ethereum smart contracts. It is designed to be secure, simple, and auditable. The language aims to mitigate common vulnerabilities found in Solidity, another popular smart contract language. Vyper is used by developers to write smart contracts that run on the Ethereum blockchain. However, a vulnerability has been discovered in Vyper that allows arrays to be indexed with negative integers, leading to unpredictable behavior and potential access to inaccessible elements.
Vulnerability Detail
The vulnerability in Vyper arises from the typechecker allowing the usage of signed integers as indexes for arrays, even though arrays are defined for unsigned integers only. While negative integers are typically filtered out at runtime by the bounds checker, certain combinations of large arrays and small negative integers can pass the bounds checker, resulting in unexpected behavior. This vulnerability can lead to unpredictable behavior in contracts and the bypassing of invariants that developers may have put in place to restrict access to certain elements. The impact of this vulnerability can range from unexpected contract behavior to potential unauthorized access to elements that were meant to be inaccessible.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
pip install --upgrade "vyper==0.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually check the index values before accessing array elements and ensure that only positive integers are used as indexes. Here is an example of how this can be done in Vyper:
arr: public(uint256[MAX_UINT256])
@external
def set(idx: int256, num: uint256):
if idx >= 0:
self.arr[idx] = num
else:
revert('Invalid index')
This workaround checks if the index is greater than or equal to 0 before accessing the array element. If the index is negative, it reverts the transaction with an error message.
Conclusion
The Vyper array negative index vulnerability allows arrays to be indexed with negative integers, leading to unpredictable behavior and potential unauthorized access to elements. To fix this vulnerability, the Vyper development team should update the typechecker to disallow the usage of signed integers as indexes for arrays. In the meantime, developers can use a temporary workaround to manually check index values before accessing array elements. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source programming language for Ethereum smart contracts. It is designed to be secure, simple, and auditable.
The impact of this vulnerability can range from unpredictable behavior in contracts to potential unauthorized access to elements that were meant to be inaccessible.
To fix this vulnerability, the Vyper development team should update the typechecker to disallow the usage of signed integers as indexes for arrays.
As a temporary workaround, developers can manually check the index values before accessing array elements and ensure that only positive integers are used as indexes.
No production contracts impacted by this vulnerability have been found.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
