Vyper bounds check on built-in `slice()` function can be overflowed

CVE-2024-24561

What is CVE-2024-24561?

The Vyper Smart Contract Language, which caters to Ethereum's virtual machine, is exposed to a vulnerability due to improper bounds checking in its slicing operations. Specifically, in versions 0.3.10 and earlier, the handling of slice arguments—namely the start and length variables—fails to consider potential overflows when these values are not literals. An attacker could leverage this oversight to perform out-of-bounds (OOB) accesses, gaining unauthorized access to storage, memory, or calldata. Moreover, this vulnerability has the potential to corrupt the length slot of the affected array, posing significant risks to the security of deployed smart contracts.

References