CVE-2024-32647: Vyper - Double Evaluation of Raw Args in create_from_blueprint
Summary
CVE-2024-32647: vyper performs double eval of raw_args in create_from_blueprint. Affects vyper versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is an open-source programming language for Ethereum smart contracts. It is designed to be secure, simple, and auditable. The create_from_blueprint function is a built-in feature in Vyper that allows the deployment of contracts based on a blueprint. It takes various arguments to customize the deployment process.
Vulnerability Detail
The create_from_blueprint function in Vyper performs a double evaluation of the args argument when raw_args=True. This can lead to a vulnerability where side-effects of the args argument are executed multiple times instead of retrieving the value from the stack. However, no vulnerable contracts were found in production, and the impact is considered low.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
pip install --upgrade "vyper==0.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The create_from_blueprint function in Vyper has a vulnerability where the args argument can be double evaluated when raw_args=True. However, no vulnerable contracts were found in production, and the impact is considered low. To fix this vulnerability, the _build_create_IR function should be modified to cache the args argument. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source programming language for Ethereum smart contracts.
The create_from_blueprint function is a built-in feature in Vyper that allows the deployment of contracts based on a blueprint.
No vulnerable contracts were found in production, and the impact is considered low.
To fix this vulnerability, the _build_create_IR function in the create_from_blueprint builtin should be modified to cache the args argument to the stack, ensuring it is evaluated only once.
No specific workaround is mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
