vyper performs double eval of raw_args in create_from_blueprint

Vulnerability

Overview

CVE-2024-32647 describes a double evaluation vulnerability in the Vyper smart contract language (versions 0.3.10 and prior). The bug resides in the create_from_blueprint builtin's _build_create_IR function, which fails to cache the args argument on the stack when raw_args=True. As a result, if the args expression has side-effects (e.g., modifying state or emitting events), those side-effects are executed multiple times instead of once [1][3].

Exploitation

Conditions

To exploit this vulnerability, an attacker must craft a Vyper contract that uses create_from_blueprint with raw_args=True and passes an args argument that produces side-effects. The double evaluation occurs during contract creation, potentially leading to unexpected behavior such as repeated state changes or resource exhaustion. No vulnerable production contracts have been identified, and the issue is considered easily discoverable through client-side testing [1].

Impact

Assessment

The impact is rated low because the double evaluation of side-effects is typically caught during development testing, and no real-world exploits have been reported. However, if left undetected, it could cause logical errors in deployed contracts, such as incorrect token minting or unauthorized state modifications [1].

Mitigation

Status

As of the publication date (2024-04-25), no official fix has been released. Users are advised to avoid using raw_args=True with side-effectful args expressions or to monitor the Vyper repository for a patched version. The PyPA advisory database also tracks this vulnerability [4].