CVE-2024-24559

Executive Summary

CVE-2024-24559 is a low-severity vulnerability in the Vyper smart contract compiler, specifically affecting the stack management during the compilation of the IR for the sha3_64 operation. The flaw involves a miscalculation of the height variable, which can lead to incorrect stack handling. However, the vulnerability cannot be triggered through standard Vyper code; it requires manually crafting the intermediate representation (IR). The sha3_64 operation is used internally for mapping lookups, but no exploitable flow that caches the key was identified. As a result, the impact is minimal, and no patch is currently available.

Supply Chain & Package Security

Vyper is a Python-based smart contract language for the Ethereum Virtual Machine (EVM). This vulnerability is a compiler-level issue and does not directly affect the supply chain of Vyper packages. However, developers using Vyper should monitor for updates, as a future patch may be released. The vulnerability is not exploitable through normal Vyper code, so the risk to deployed smart contracts is negligible.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability is in the compiler, which is typically used in a networked development environment.
• Attack Complexity: High (AC:H) – Exploitation requires manual IR crafting and deep understanding of the compiler internals.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Potential for incorrect stack state, but no direct data manipulation.
• Availability Impact: None (A:N)

Threat Level: Low. The vulnerability is not exploitable in standard usage and requires advanced knowledge to trigger.

Deep Dive & Mechanics

The vulnerability resides in the Vyper compiler's handling of the sha3_64 IR operation. The sha3_64 operation is used internally for mapping key lookups. During compilation, the compiler tracks the stack height to ensure correct operand placement. A miscalculation in the height variable occurs when compiling the IR for sha3_64, leading to potential stack misalignment.

Technical Details:

• The height variable is used to track the number of elements on the EVM stack.
• In the sha3_64 IR compilation, the height is incorrectly incremented or decremented, causing the compiler to generate bytecode with an incorrect stack state.
• This can result in the wrong values being used in subsequent operations, potentially leading to logic errors in the compiled smart contract.
• However, the vulnerability is only triggerable when manually writing the IR, not through standard Vyper source code. The compiler's own generated IR for mappings does not trigger the bug.

Root Cause: Improper initialization or update of the stack height variable in the compiler's IR compilation logic for sha3_64.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, the vulnerable code path is in the Vyper compiler's IR compilation module, specifically in the handling of sha3_64. The fix would involve correcting the height calculation to accurately reflect the stack changes.

Vulnerable Code (Conceptual):

# In compiler/ir.py (hypothetical)
def compile_sha3_64(ir_node):
    # ... some operations ...
    height += 1  # Incorrect: should be height += 2 or similar
    # ... more operations ...

Patched Code (Hypothetical):

# In compiler/ir.py (hypothetical)
def compile_sha3_64(ir_node):
    # ... some operations ...
    height += 2  # Corrected calculation
    # ... more operations ...

Exploitation & Lab Setup

Red Team

Exploitation of CVE-2024-24559 is not feasible in a real-world scenario due to the following constraints:

• The vulnerability cannot be triggered from standard Vyper code.
• It requires manual crafting of the IR, which is an internal representation not exposed to developers.
• No known exploit code or proof-of-concept exists.

Lab Setup for Research:

1. Install a vulnerable version of the Vyper compiler (e.g., version 0.3.10 or earlier).
2. Manually create an IR file that uses sha3_64 with a crafted stack height.
3. Compile the IR using the Vyper compiler's IR compilation path.
4. Observe the generated bytecode for stack inconsistencies.

Example IR (Hypothetical):

sha3_64:
  push 0x01
  push 0x02
  sha3_64
  stop

Blue Team

Since the vulnerability is not exploitable in standard usage, detection is not practical. However, for defense-in-depth:

• Monitor for unusual compiler behavior or crashes when compiling Vyper code.
• Ensure that only trusted Vyper compiler versions are used in development pipelines.
• Implement code reviews for any custom IR modifications.

Indicators of Compromise (IOCs)

No IOCs are available for this vulnerability as it is a compiler-level issue with no known exploitation.

Detection Engineering

YARA Rule

rule CVE_2024_24559_Vyper_Compiler {
  meta:
    description = "Detects Vyper compiler versions potentially vulnerable to CVE-2024-24559"
    author = "Valters IT"
    date = "2024-01-01"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24559"
  strings:
    $compiler_version = /Vyper v0\.3\.(?:[0-9]|1[0-0])/  // Versions up to 0.3.10
  condition:
    $compiler_version
}

Sigma Rule

title: Potential Vyper Compiler Vulnerability CVE-2024-24559
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects compilation of Vyper code that may trigger CVE-2024-24559
author: Valters IT
logsource:
  product: linux
  service: syslog
detection:
  selection:
    - "vyper" and "sha3_64" and "error"
  condition: selection
falsepositives:
  - Legitimate compiler errors
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-24559 Vyper Compiler Exploit Attempt"; content:"sha3_64"; depth:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate Action: No patch is available. Monitor the Vyper project for updates.
• Mitigation: Since the vulnerability cannot be triggered from standard Vyper code, no immediate action is required for deployed contracts.
• Long-term: Update to the latest Vyper compiler version once a patch is released. Review any custom IR usage in development pipelines.

Valters IT
Securing the blockchain, one byte at a time.