vyper performs incorrect topic logging in raw_log

Vulnerability

In Vyper versions 0.3.10 and prior, the raw_log builtin function incorrectly logs topic values when memory or storage arguments are passed. The build_IR function of the RawLog class fails to properly unwrap the variables provided as topics, leading to incorrect topic values being emitted [1][4].

Exploitation

An attacker could exploit this by crafting a contract that calls raw_log with memory or storage variables as topics. However, a contract search performed by the Vyper team found no vulnerable contracts in production, and raw_log appears to be rarely used [1][4]. Exploitation requires the attacker to control the contract code, meaning the vulnerability is primarily a correctness issue rather than an external attack vector.

Impact

The incorrect logging of topics can cause client-side applications that rely on event logs to malfunction, as the logged topics do not match the intended values. This could lead to unexpected behavior in applications such as wallets or dApps that parse these logs [4].

Mitigation

As of publication, no patched version of Vyper is available. The issue has been fixed in pull request #3977 on the Vyper GitHub repository. Users are advised to update once a new version is released or avoid using raw_log with memory/storage arguments until then [1][4].