CVE-2024-32649

Vyper's `sqrt` builtin may cause double evaluation of arguments with side-effects.

• CVSS 5.3
• CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
• Numeric Errors
• Remote

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.

CVE

CVE-2024-32649

CWE

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CVSS base score

5.3

Published

2024-04-25

OWASP

A09 Security Logging and Monitoring Failures

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Numeric Errors

Subcategory

Arithmetic Errors

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Vyper

Fixed by upgrading

Yes

Solution

Upgrade to Vyper version 0.3.11 or later when available.

# Example of a vulnerable Vyper smart contract
# This contract demonstrates the double evaluation vulnerability with sqrt

# @version ^0.3.10
contract VulnerableContract:
num: public(uint256)

@public
@pure
def calculate_sqrt_with_side_effects() -> uint256:
    self.num += 1  # Side effect
    return sqrt(self.num)  # Vulnerable to double evaluation

# Example of a vulnerable Vyper smart contract
# This contract demonstrates the double evaluation vulnerability with sqrt

# @version ^0.3.10
contract VulnerableContract:
num: public(uint256)

@public
@pure
def calculate_sqrt_with_side_effects() -> uint256:
    self.num += 1  # Side effect
    return sqrt(self.num)  # Vulnerable to double evaluation

# Example of the fixed version
# @version ^0.3.11
    contract FixedContract:
    num: public(uint256)

    @public
    @pure
    def calculate_sqrt_with_side_effects() -> uint256:
        temp_num: uint256 = self.num + 1  # Cache the result of the side effect
        return sqrt(temp_num)  # No double evaluation

# Example payload to exploit the vulnerability
# This payload calls the vulnerable contract method that uses sqrt with side effects

contract = VulnerableContract()
contract.calculate_sqrt_with_side_effects()  # This would cause self.num to be incremented twice

@misc{vaitp:cve202432649,
  title        = {{Vyper's `sqrt` builtin may cause double evaluation of arguments with side-effects.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-32649},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-32649/}}
}