Vyper bounds check on built-in `slice()` function can be overflowed

Vulnerability

In Vyper versions 0.3.10 and earlier, the bounds check for the built-in slice() function fails to account for integer overflow when start + length overflows and the arguments are not literals [1][2]. This allows an attacker to bypass the intended memory access controls.

Exploitation

The vulnerability is exploitable when a user supplies non-literal values for start or length to slice(). At compile time, checks only apply to literal values; at runtime, the check assert le(add(start, length), src_len) does not consider overflow [2]. By crafting values that cause start + length to wrap around (e.g., sum exceeding 2^256-1), the attacker can pass the bounds check and access out-of-bounds storage, memory, or calldata.

Impact

Successful exploitation allows out-of-bounds read/write operations, potentially extracting sensitive data or corrupting array length slots, leading to arbitrary state manipulation [1]. No vulnerable contracts were found in production [2].

Mitigation

The issue is patched in Vyper version 0.3.11 (commit #3818) [2]. Users should upgrade immediately. No workaround is available for affected versions.