CVE-2024-32649: vyper performs double eval of the argument of sqrt

First published: Thu Apr 25 2024(Updated: )

### Summary Using the `sqrt` builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914). A contract search was performed and no vulnerable contracts were found in production. ### Details It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack: https://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L2151 As such, it can be evaluated multiple times (instead of retrieving the value from the stack). ### PoC With at least Vyper version `0.2.15+commit.6e7dba7` the following contract: ```vyper c: uint256 @internal def some_decimal() -> decimal: self.c += 1 return 1.0 @external def foo() -> uint256: k: decimal = sqrt(self.some_decimal()) return self.c ``` passes the following test: ```solidity // SPDX-License-Identifier: MIT pragma solidity >=0.8.13; import "../../lib/ds-test/test.sol"; import "../../lib/utils/Console.sol"; import "../../lib/utils/VyperDeployer.sol"; import "../ITest.sol"; contract ConTest is DSTest { VyperDeployer vyperDeployer = new VyperDeployer(); ITest t; function setUp() public { t = ITest(vyperDeployer.deployContract("Test")); } function testFoo() public { uint256 val = t.foo(); console.log(val); assert (val == 4); } } ``` ### Patches Patched in https://github.com/vyperlang/vyper/pull/3976. ### Impact No vulnerable production contracts were found.

Credit: security-advisories@github.com security-advisories@github.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/weakness
• agent/title
• agent/type
• agent/first-publish-date
• agent/severity
• agent/references
• agent/event
• agent/author
• collector/nvd-cve
• source/NVD
• collector/epss-latest
• source/FIRST
• agent/epss
• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-5jrj-52x8-m64h
• alias/CVE-2024-32649
• agent/software-canonical-lookup
• collector/github-advisory
• agent/softwarecombine
• agent/description
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/trending
• agent/tags
• collector/nvd-api
• package-manager/pip
• vendor/vyperlang
• canonical/vyperlang vyper