Vyper bounds check on built-in `slice()` function can be overflowed

CVE-2024-24561

What is CVE-2024-24561?

The Vyper Smart Contract Language, which caters to Ethereum's virtual machine, is exposed to a vulnerability due to improper bounds checking in its slicing operations. Specifically, in versions 0.3.10 and earlier, the handling of slice arguments—namely the start and length variables—fails to consider potential overflows when these values are not literals. An attacker could leverage this oversight to perform out-of-bounds (OOB) accesses, gaining unauthorized access to storage, memory, or calldata. Moreover, this vulnerability has the potential to corrupt the length slot of the affected array, posing significant risks to the security of deployed smart contracts.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References