CVE-2024-32645: vyper - Incorrect Topic Logging in raw_log
Summary
CVE-2024-32645: vyper performs incorrect topic logging in raw_log. Affects vyper versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is an open-source Python-based language used for writing smart contracts on the Ethereum blockchain. It is designed to be secure and efficient, providing developers with a high-level language for contract development. However, a vulnerability has been discovered in the raw_log function of Vyper, which can result in incorrect values being logged as topics. This can lead to unexpected behavior in client-side applications that rely on these logs.
Vulnerability Detail
The vulnerability arises from the build_IR function of the RawLog class in Vyper. When the raw_log function is called with memory or storage arguments to be used as topics, the variables provided as topics are not properly unwrapped. As a result, incorrect values are logged as topics. This can have various ramifications, including the potential for unexpected behavior in client-side applications that rely on these logs.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
pip install --upgrade "vyper==0.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As no vulnerable contracts using raw_log() were found in production, it appears that this function is not widely used. Therefore, there is no specific workaround provided for this vulnerability.
Conclusion
In conclusion, the vulnerability in Vyper's raw_log function can result in incorrect values being logged as topics, potentially leading to unexpected behavior in client-side applications. It is recommended to update the Vyper compiler to a version that includes the fix for this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source Python-based language used for writing smart contracts on the Ethereum blockchain. It provides developers with a high-level language for contract development.
The vulnerability can result in incorrect values being logged as topics in the raw_log function of Vyper. This can lead to unexpected behavior in client-side applications that rely on these logs.
No known exploits of this vulnerability have been reported at this time.
To fix this vulnerability, you need to update your Vyper compiler to a version that includes the fix for this issue. Once the updated compiler is installed, you can recompile your contracts to ensure the correct values are logged as topics.
Yes, the CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
