Vyper _abi_decode Memory Overflow

Root

Cause

CVE-2024-26149 describes an integer overflow vulnerability in Vyper's _abi_decode function. When decoding arrays, if an excessively large value is specified as the starting index, the read position arithmetic overflows, causing the decoder to access memory outside the intended array bounds [1]. This flaw affects Vyper versions 0.3.10 and earlier.

Exploitation

An attacker can exploit this by crafting calldata that includes a manipulated array start index. The vulnerability can be triggered in any smart contract that uses _abi_decode to process untrusted input arrays, potentially without requiring authentication if the contract exposes such decoding to external callers [2].

Impact

Successful exploitation allows an attacker to read arbitrary memory locations outside the decoded array. This could lead to information disclosure of sensitive contract data or manipulation of contract state, depending on the context of the decoded values [1].

Mitigation

The Vyper team has addressed this vulnerability in a patch merged via pull request #4060 [4]. Users are strongly advised to upgrade to a patched version of the Vyper compiler and recompile their contracts to eliminate the overflow risk [2].