AugAssign evaluation order causing OOB write within the object in Vyper

Vulnerability

Description

The Vyper compiler handles augmented assignment statements (e.g., a[i] += expr) by caching the target location to avoid evaluating the target expression twice. However, when the target is an element of a dynamic array (DynArray) and the right-hand side (expr) modifies the same array, the cached target is evaluated before the array is mutated. As a result, the bounds check performed during the read portion of the statement is not repeated during the write portion, allowing an out-of-bounds write [1][4].

Exploitation

An attacker can exploit this by crafting a Vyper smart contract that performs an augmented assignment on a dynamic array element where the right-hand side operation modifies the array (e.g., a[1] += a.pop()). The intended behavior is to revert if the write index is out of bounds, but due to the bug, the write proceeds to an invalid memory location. No special network position or authentication is required beyond the ability to deploy and trigger the vulnerable code path [4].

Impact

Successful exploitation leads to an out-of-bounds write within the contract's memory. This can corrupt adjacent data, potentially enabling arbitrary memory modification or contract state compromise, depending on surrounding contract logic.

Mitigation

The issue has been fixed in Vyper version 0.4.1. All users are advised to upgrade to this version or later. There are no known workarounds for this vulnerability [1][4].