Vyper array negative index vulnerability

Vulnerability

Description

The Vyper smart contract language's typechecker allows signed integers (int) to be used as array indices, even though arrays are defined only for unsigned integers. The bounds checking code validates the index against IntegerT.any(), accepting signed types [1][2][4]. When a signed negative integer is used, its two's complement representation is interpreted as a very large unsigned number. If the array is declared large enough (e.g., MAX_UINT256), the negative index passes the bounds check, enabling access to memory outside the intended array range [2].

Exploitation

Prerequisites

Exploitation requires the contract to declare an array with an extremely large size (at least 2^255 elements) and a function that accepts a signed integer index. An attacker can supply a negative value that, after conversion, yields a valid index within the large array bounds. This can lead to reading or writing to unexpected storage slots, bypassing developer assumptions about index ranges [2].

Impact

Three hypothetical impact classes are identified: (1) unpredictable contract behavior due to accessing unintended slots, (2) bypassing invariants like assert index < x by using negative indices that map to large positive values, and (3) denial of service if the index depends on contract state that can be forced negative, causing array access to revert. However, the advisory notes that these scenarios are highly unlikely in practice, and the most likely result is a revert on the bounds check [1].

Mitigation

Status

As of publication, no fixed version of Vyper exists [1][2]. Developers are advised to avoid declaring extremely large arrays and to implement additional index validation in user-facing functions. The vulnerability affects all Vyper versions, including 0.3.10 [1][2].