CVE-2024-24563

Executive Summary

CVE-2024-24563 is a critical vulnerability in the Vyper smart contract language, affecting all versions including 0.3.10. The flaw allows signed integers to be used as array indices, bypassing the intended unsigned integer constraint. This can lead to unpredictable behavior, unauthorized access to array elements, or denial of service. With a CVSS score of 9.8, this vulnerability poses a severe risk to Ethereum smart contracts written in Vyper.

Supply Chain & Package Security

Vyper is a Pythonic smart contract language for the Ethereum Virtual Machine (EVM). This vulnerability affects all Vyper contracts that use arrays with signed integer indices. Since Vyper is a language and compiler, the supply chain risk is primarily to developers and projects using Vyper to build smart contracts. No package manager (like PyPI) is directly involved, but the compiler itself is the vulnerable component.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it highly dangerous for any Vyper-based smart contract.

Deep Dive & Mechanics

The core issue lies in Vyper's type checker, which fails to reject signed integers (int) when used as array indices. Arrays in Vyper are defined for unsigned integers (uint) only, but the compiler does not enforce this restriction. When a signed integer is used, it is interpreted in two's complement form. For example, -1 becomes a very large unsigned integer (e.g., 2^256 - 1). If the array is declared large enough, the bounds check passes, allowing access to unintended memory locations.

Three vulnerability classes emerge:

1. Unpredictable Behavior: Accessing array elements with negative indices can lead to unexpected contract states.
2. Accessing Inaccessible Elements: Developers may assume assert index < x protects against out-of-bounds access, but negative indices bypass this.
3. Denial of Service: If the index depends on contract state, an attacker can force a negative index, causing the array access to revert (if the array is not extremely large).

Vulnerable vs. Patched Code

Vulnerable Code (Vyper 0.3.10):

@external
def vulnerable_function(index: int128) -> uint256:
    arr: uint256[10] = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
    return arr[index]  # No type check on signed integer

Patched Code (Hypothetical Fix):

@external
def patched_function(index: uint256) -> uint256:
    arr: uint256[10] = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
    assert index < 10  # Explicit bounds check
    return arr[index]

The fix requires the compiler to reject signed integer indices or enforce explicit bounds checking.

Exploitation & Lab Setup

Red Team

Exploit Scenario: An attacker crafts a transaction that calls a vulnerable Vyper contract function with a negative index. For example, using -1 as an index to access an array element that should be out of bounds.

Proof-of-Concept (Python with Web3):

from web3 import Web3

w3 = Web3(Web3.HTTPProvider('http://localhost:8545'))
contract_address = '0x...'
abi = [...]  # ABI of vulnerable contract

contract = w3.eth.contract(address=contract_address, abi=abi)
# Call vulnerable function with negative index
tx_hash = contract.functions.vulnerable_function(-1).transact({'from': w3.eth.accounts[0]})
receipt = w3.eth.wait_for_transaction_receipt(tx_hash)
print(receipt)

Lab Setup:

1. Deploy a Vyper contract with the vulnerable code on a local Ethereum testnet (e.g., Ganache).
2. Use a Python script with Web3 to interact with the contract.
3. Monitor the transaction receipt for unexpected behavior.

Blue Team

Detection:

• Monitor for transactions with negative integer parameters in Vyper contract calls.
• Use static analysis tools to scan Vyper source code for signed integer array indices.

Mitigation:

• Update Vyper compiler to a patched version when available.
• Implement explicit bounds checks in all array accesses.
• Use only unsigned integers for array indices.

Indicators of Compromise (IOCs)

• Transaction Patterns: Transactions with negative integer values in function parameters that are used as array indices.
• Contract Behavior: Unexpected reverts or out-of-bounds access errors.
• Logs: EVM logs showing array index out-of-bounds exceptions.

Detection Engineering

YARA Rule

rule Vyper_Signed_Index_Vuln {
    meta:
        description = "Detects Vyper smart contract bytecode with signed integer array index vulnerability"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-24563"
    strings:
        $signed_index = { 63 ?? 02 }  // Example opcode pattern for signed index
    condition:
        $signed_index
}

Sigma Rule

title: Vyper Signed Integer Array Index Vulnerability
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects transactions exploiting CVE-2024-24563 in Vyper smart contracts
logsource:
    category: ethereum
    product: blockchain
detection:
    selection:
        function_params|contains: -1
    condition: selection
falsepositives:
    - Legitimate use of negative values in other contexts
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-24563 Vyper Signed Integer Array Index Exploit"; content:"|63 02|"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Review all Vyper smart contracts for array accesses using signed integers. Replace with unsigned integers and add explicit bounds checks.
2. Compiler Update: Monitor Vyper's official repository for a patched version. Apply the update as soon as it is released.
3. Static Analysis: Use tools like Slither or Mythril to scan for this vulnerability.
4. Runtime Monitoring: Implement monitoring for unusual transaction parameters that could indicate exploitation attempts.
5. Contract Pause: If a vulnerable contract is in production, consider pausing it until a fix is applied.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert