Описание
vyper performs double eval of raw_args in create_from_blueprint
Summary
Using the create_from_blueprint builtin can result in a double eval vulnerability when raw_args=True and the args argument has side-effects.
A contract search was performed and no vulnerable contracts were found in production. In particular, the raw_args variant of create_from_blueprint was not found to be used in production.
Details
It can be seen that the _build_create_IR function of the create_from_blueprint builtin doesn't cache the mentioned args argument to the stack: https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847
As such, it can be evaluated multiple times (instead of retrieving the value from the stack).
PoC
The vulnerability is demonstrated in the following boa test:
The output of c2.deployed() is 2 although create_ was called only once and the value was initialized to 0.
Patches
Patched in https://github.com/vyperlang/vyper/pull/3976.
Impact
No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low.
Ссылки
- https://github.com/vyperlang/vyper/security/advisories/GHSA-3whq-64q2-qfj6
- https://nvd.nist.gov/vuln/detail/CVE-2024-32647
- https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-208.yaml
- https://github.com/vyperlang/vyper/blob/cedf7087e68e67c7bfbd47ae95dcb16b81ad2e02/vyper/builtins/functions.py#L1847
Пакеты
vyper
< 0.4.0
0.4.0
Связанные уязвимости
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn't cache the mentioned `args` argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions exist.