concat built-in can corrupt memory in vyper

CVE-2024-22419

What is CVE-2024-22419?

A buffer overflow vulnerability has been identified in Vyper, a Pythonic smart contract language designed to run on the Ethereum Virtual Machine. The issue arises from the concat built-in function, which has the potential to overwrite memory beyond its allocated buffer, leading to the corruption of existing data. This vulnerability is traced back to improper adherence to the copy function APIs in the build_IR of concat. Although a contract search revealed no vulnerable contracts in production, the length-dependent nature of the overflow could result in unnoticed issues during contract testing. While not all usages of the concat function yield detrimental results, it is essential for developers to address this vulnerability promptly, as it affects contract semantics. This issue has been resolved in version 0.4.0 of Vyper.

References