GHSA-5jrj-52x8-m64h

Опубликовано: 25 апр. 2024

Источник: github

Github: Прошло ревью

CVSS3: 5.3

Описание

vyper performs multiple eval of sqrt() argument built in

Summary

Using the sqrt builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).

A contract search was performed and no vulnerable contracts were found in production.

Details

It can be seen that the build_IR function of the sqrt builtin doesn't cache the argument to the stack: https://github.com/vyperlang/vyper/blob/4595938734d9988f8e46e8df38049ae0559abedb/vyper/builtins/functions.py#L2151

As such, it can be evaluated multiple times (instead of retrieving the value from the stack).

PoC

With at least Vyper version 0.2.15+commit.6e7dba7 the following contract:

c: uint256 @internal def some_decimal() -> decimal: self.c += 1 return 1.0 @external def foo() -> uint256: k: decimal = sqrt(self.some_decimal()) return self.c

passes the following test:

// SPDX-License-Identifier: MIT pragma solidity >=0.8.13; import "../../lib/ds-test/test.sol"; import "../../lib/utils/Console.sol"; import "../../lib/utils/VyperDeployer.sol"; import "../ITest.sol"; contract ConTest is DSTest { VyperDeployer vyperDeployer = new VyperDeployer(); ITest t; function setUp() public { t = ITest(vyperDeployer.deployContract("Test")); } function testFoo() public { uint256 val = t.foo(); console.log(val); assert (val == 4); } }

Patches

Patched in https://github.com/vyperlang/vyper/pull/3976.

Impact

No vulnerable production contracts were found.

Ссылки

Пакеты

Наименование

vyper

pip

Затронутые версииВерсия исправления

< 0.4.0

0.4.0

EPSS

Процентиль: 71%

0.00685

Низкий

5.3 Medium

CVSS3

CVE ID

CVE-2024-32649

Дефекты

CWE-95

Связанные уязвимости

CVE-2024-32649

CVSS3: 5.3

nvd

почти 2 года назад

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.

EPSS

Процентиль: 71%

0.00685

Низкий

5.3 Medium

CVSS3

CVE ID

CVE-2024-32649

Дефекты

CWE-95