CVE-2024-24559

Use of a Broken or Risky Cryptographic Algorithm in pypi/vyper

Identifiers

GHSA-6845-xw22-ffxv, CVE-2024-24559

Package Slug

pypi/vyper

Vulnerability

Use of a Broken or Risky Cryptographic Algorithm

Description

Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the IR for sha3_64. Concretely, the height variable is miscalculated. The vulnerability can't be triggered without writing the IR by hand (that is, it cannot be triggered from regular vyper code). sha3_64 is used for retrieval in mappings. No flow that would cache the key was found so the issue shouldn't be possible to trigger when compiling the compiler-generated IR. This issue isn't triggered during normal compilation of vyper code so the impact is low. At the time of publication there is no patch available.

Affected Versions

All versions up to 0.3.10

Solution

Unfortunately, there is no solution available yet.

Last Modified

2024-02-06

source