CVE-2024-32645: vyper performs incorrect topic logging in raw_log
Summary Incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics.
A contract search was performed and no vulnerable contracts were found in production. In particular, no uses of rawlog() were found at all in production; it is apparently not a well-known function.
Details The buildIR function of the RawLog class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics.
PoC vyper x: bytes32
@external def f(): self.x = 0x1234567890123456789012345678901234567890123456789012345678901234 rawlog([self.x], b"") # LOG1(offset:0x60, size:0x00, topic1:0x00)
y: bytes32 = 0x1234567890123456789012345678901234567890123456789012345678901234 rawlog([y], b"") # LOG1(offset:0x80, size:0x00, topic1:0x40) Patches Fixed in https://github.com/vyperlang/vyper/pull/3977.
Impact Incorrect values can be logged which may result in unexpected behavior in client-side applications relying on these logs.
Other sources
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when rawlog builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The buildIR function of the RawLog class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What vulnerabilities are associated with CVE-2024-32645?
CVE-2024-32645 is associated with incorrect values being logged when the raw_log builtin is called with memory or storage arguments.
How can I mitigate CVE-2024-32645 in my Vyper contracts?
To mitigate CVE-2024-32645, avoid using the raw_log() function with memory or storage arguments.
What versions of Vyper are affected by CVE-2024-32645?
CVE-2024-32645 affects Vyper versions up to and including 0.4.0.
Are there any known exploits for CVE-2024-32645?
As of now, there are no known exploits for CVE-2024-32645 in production contracts.
What should I do if I am using an affected version of Vyper related to CVE-2024-32645?
If you are using an affected version of Vyper, it is recommended to upgrade to a version that does not have this vulnerability.