GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GHSA-5JRJ-52X8-M64H

Vulnerability from github – Published: 2024-04-25 19:50 – Updated: 2025-01-21 17:53
VLAI
Summary
vyper performs multiple eval of `sqrt()` argument built in
Details

Summary

Using the sqrt builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).

A contract search was performed and no vulnerable contracts were found in production.

Details

It can be seen that the build_IR function of the sqrt builtin doesn't cache the argument to the stack: https://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L2151

As such, it can be evaluated multiple times (instead of retrieving the value from the stack).

PoC

With at least Vyper version 0.2.15+commit.6e7dba7 the following contract:

c: uint256

@internal
def some_decimal() -> decimal:
    self.c += 1
    return 1.0

@external
def foo() -> uint256:
    k: decimal = sqrt(self.some_decimal())
    return self.c

passes the following test:

// SPDX-License-Identifier: MIT
pragma solidity >=0.8.13;

import "../../lib/ds-test/test.sol";
import "../../lib/utils/Console.sol";
import "../../lib/utils/VyperDeployer.sol";

import "../ITest.sol";

contract ConTest is DSTest {
    VyperDeployer vyperDeployer = new VyperDeployer();

    ITest t;

    function setUp() public {
        t = ITest(vyperDeployer.deployContract("Test"));
    }

    function testFoo() public {
        uint256 val = t.foo();
        console.log(val);
        assert (val == 4);
    }
}

Patches

Patched in https://github.com/vyperlang/vyper/pull/3976.

Impact

No vulnerable production contracts were found.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "vyper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32649"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-25T19:50:16Z",
    "nvd_published_at": "2024-04-25T18:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nUsing the `sqrt` builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).\n\nA contract search was performed and no vulnerable contracts were found in production.\n\n### Details\nIt can be seen that the `build_IR` function of the `sqrt` builtin doesn\u0027t cache the argument to the stack: \nhttps://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L2151\n\nAs such, it can be evaluated multiple times (instead of retrieving the value from the stack).\n\n### PoC\nWith at least Vyper version `0.2.15+commit.6e7dba7` the following contract:\n```vyper\nc: uint256\n\n@internal\ndef some_decimal() -\u003e decimal:\n    self.c += 1\n    return 1.0\n\n@external\ndef foo() -\u003e uint256:\n    k: decimal = sqrt(self.some_decimal())\n    return self.c\n```\npasses the following test:\n```solidity\n// SPDX-License-Identifier: MIT\npragma solidity \u003e=0.8.13;\n\nimport \"../../lib/ds-test/test.sol\";\nimport \"../../lib/utils/Console.sol\";\nimport \"../../lib/utils/VyperDeployer.sol\";\n\nimport \"../ITest.sol\";\n\ncontract ConTest is DSTest {\n    VyperDeployer vyperDeployer = new VyperDeployer();\n\n    ITest t;\n\n    function setUp() public {\n        t = ITest(vyperDeployer.deployContract(\"Test\"));\n    }\n\n    function testFoo() public {\n        uint256 val = t.foo();\n        console.log(val);\n        assert (val == 4);\n    }\n}\n```\n \n### Patches\nPatched in https://github.com/vyperlang/vyper/pull/3976.\n\n### Impact\nNo vulnerable production contracts were found.",
  "id": "GHSA-5jrj-52x8-m64h",
  "modified": "2025-01-21T17:53:44Z",
  "published": "2024-04-25T19:50:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-5jrj-52x8-m64h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32649"
    },
    {
      "type": "WEB",
      "url": "https://github.com/vyperlang/vyper/pull/2914"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-209.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vyperlang/vyper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "vyper performs multiple eval of `sqrt()` argument built in"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.