CVE-2024-32647: vyper performs double eval of raw_args in create_from_blueprint

Summary Using the createfromblueprint builtin can result in a double eval vulnerability when rawargs=True and the args argument has side-effects.

A contract search was performed and no vulnerable contracts were found in production. In particular, the rawargs variant of createfromblueprint was not found to be used in production.

Details It can be seen that the buildcreateIR function of the createfromblueprint builtin doesn't cache the mentioned args argument to the stack: https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847

As such, it can be evaluated multiple times (instead of retrieving the value from the stack).

PoC The vulnerability is demonstrated in the following boa test: vyper src1 = """ c: uint256 """ deployer = """ createdaddress: public(address) deployed: public(uint256)

@external def get() -> Bytes[32]: self.deployed += 1 return b''

@external def create(target: address): self.createdaddress = createfromblueprint(target, rawcall(self, methodid("get()"), maxoutsize=32), rawargs=True, codeoffset=3) """

Factory = b.loadspartial(src1) c = Factory.deployasblueprint()

c2 = b.loads(deployer, b'') c2.create(c) c2.deployed() The output of c2.deployed() is 2 although create was called only once and the value was initialized to 0.

Patches Patched in https://github.com/vyperlang/vyper/pull/3976.

Impact No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low.