CVE-2024-32649: vyper performs multiple eval of `sqrt()` argument built in

April 25, 2024 (updated January 21, 2025)

Using the sqrt builtin can result in multiple eval evaluation of side effects when the argument has side-effects. The bug is more difficult (but not impossible!) to trigger as of 0.3.4, when the unique symbol fence was introduced (https://github.com/vyperlang/vyper/pull/2914).

A contract search was performed and no vulnerable contracts were found in production.

References

github.com/advisories/GHSA-5jrj-52x8-m64h
github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-209.yaml
github.com/vyperlang/vyper
github.com/vyperlang/vyper/pull/2914
github.com/vyperlang/vyper/security/advisories/GHSA-5jrj-52x8-m64h
nvd.nist.gov/vuln/detail/CVE-2024-32649

Code Behaviors & Features

Detect and mitigate CVE-2024-32649 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →