CVE-2024-32645

Incorrect values logged in Vyper's `raw_log` with memory/storage topics.

• CVSS 5.3
• CWE-20 Improper Input Validation
• Design Defects
• Remote

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available.

CVE

CVE-2024-32645

CWE

CWE-20 Improper Input Validation

CVSS base score

5.3

Published

2024-04-25

OWASP

A01 Broken Access Control

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Design Defects

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Vyper

Fixed by upgrading

Yes

Solution

Upgrade to Vyper version 0.3.11 or later, once available.

class RawLog:
    def build_IR(self, topics):
        self.log(topics)

    def log(self, topics):
        print("Logging topics:", topics)

raw_log = RawLog()
raw_log.build_IR(['0x123', '0x456'])

import threading

class RawLog:
    def __init__(self):
        self._lock = threading.Lock()

    def build_IR(self, topics):
        if not isinstance(topics, list):
            raise ValueError("Topics must be a list.")
        try:
            unwrapped_topics = [self.unwrap_topic(topic) for topic in topics]
        except Exception as e:
            print(f"Error while unwrapping topics: {e}")
            return
        self.log(unwrapped_topics)

    def unwrap_topic(self, topic):
        if not isinstance(topic, str) or not topic.startswith("0x"):
            raise ValueError(f"Invalid topic format: {topic}")
        return topic

    def log(self, topics):
        with self._lock:
            print("Logging topics:", topics)

raw_log = RawLog()
raw_log.build_IR(['0x123', '0x456'])

# Example payload to exploit the vulnerability by passing memory or storage arguments
raw_log.build_IR(['0x123', some_memory_variable])  # where `some_memory_variable` could be a memory reference

@misc{vaitp:cve202432645,
  title        = {{Incorrect values logged in Vyper's `raw_log` with memory/storage topics.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-32645},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-32645/}}
}