CVE-2024-32647
Assigner: GitHub_M
Published: 2024-04-25T17:41:44.052Z
State: PUBLISHED
title: vyper performs double eval of raw_args in create_from_blueprint
problemTypes: descriptions: cweId: CWE-95
description: CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
affected: vendor: vyperlang
product: vyper
versions: version: <= 0.3.10
status: affected
descriptions: value: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist.

source: advisory: GHSA-3whq-64q2-qfj6
discovery: UNKNOWN