CVE-2023-46247

Storage slot calculation in Vyper prior to v0.3.8 may underallocate by 1 for large arrays with specific byte sizes.

• CVSS 7.5
• CWE-193 Off-by-one Error
• Numeric Errors
• Remote

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used `math.ceil(type_.size_in_bytes / 32)`. The intermediate floating point step can produce a rounding error if there are enough bits set in the IEEE-754 mantissa. Roughly speaking, if `type_.size_in_bytes` is large (> 2**46), and slightly less than a power of 2, the calculation can overestimate how many slots are needed by 1. If `type_.size_in_bytes` is slightly more than a power of 2, the calculation can underestimate how many slots are needed by 1. This issue is patched in version 0.3.8.

CVE

CVE-2023-46247

CWE

CWE-193 Off-by-one Error

CVSS base score

7.5

Published

2023-12-13

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Numeric Errors

Subcategory

Rounding Errors

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Vyper to version 0.3.8 and later

import math

def calculate_storage_slots(size_in_bytes):
    """Vulnerable function that demonstrates the security issue."""
    return math.ceil(size_in_bytes / 32)

size_in_bytes = 2**46 - 1
slots_needed = calculate_storage_slots(size_in_bytes)
print(slots_needed)

def calculate_storage_slots(size_in_bytes):
    """Secure function that fixes the vulnerability."""
    return (size_in_bytes + 31) // 32

size_in_bytes = 2**46 - 1
slots_needed = calculate_storage_slots(size_in_bytes)
print(slots_needed)

@misc{vaitp:cve202346247,
  title        = {{Storage slot calculation in Vyper prior to v0.3.8 may underallocate by 1 for large arrays with specific byte sizes.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-46247},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-46247/}}
}