CVE-2024-24567: Vyper's raw_call `value=` kwargs not disabled for static and delegate calls
(updated )
Vyper compiler allows passing a value in builtin raw_call
even if the call is a delegatecall
or a staticcall
. But in the context of delegatecall
and staticcall
the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value=
argument.
A contract search was performed and no vulnerable contracts were found in production.
References
- github.com/advisories/GHSA-x2c2-q32w-4w6m
- github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-151.yaml
- github.com/vyperlang/vyper
- github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/builtins/functions.py
- github.com/vyperlang/vyper/commit/a2df08888c318713742c57f71465f32a1c27ed72
- github.com/vyperlang/vyper/pull/3755
- github.com/vyperlang/vyper/security/advisories/GHSA-x2c2-q32w-4w6m
- nvd.nist.gov/vuln/detail/CVE-2024-24567
Detect and mitigate CVE-2024-24567 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →