CVE-2024-32647

Executive Summary

CVE-2024-32647 is a double evaluation vulnerability in the Vyper smart contract language (versions 0.3.10 and prior). The flaw resides in the create_from_blueprint built-in function when used with raw_args=True. Due to improper caching of the args argument on the stack, the argument can be evaluated multiple times, leading to unintended side-effects. While no production contracts were found to be vulnerable, the issue could be exploited in contracts that rely on side-effect-heavy arguments. The CVSS score is 5.3 (Medium), and no official patch exists at this time.

Supply Chain & Package Security

This vulnerability affects the Vyper compiler, which is a critical component in the Ethereum smart contract development toolchain. Developers using Vyper to compile contracts that utilize create_from_blueprint with raw_args=True are at risk. The impact is limited to contracts where the args parameter has side-effects (e.g., state changes, external calls). Since Vyper is a Python-based language, the supply chain risk is moderate, but no malicious packages have been identified.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires specific conditions (side-effect arguments) and is not widely exploitable in production.

Deep Dive & Mechanics

The create_from_blueprint built-in in Vyper allows deploying new contracts from a blueprint. When raw_args=True, the args parameter is passed directly to the constructor of the new contract. The vulnerability arises because the _build_create_IR function does not cache the args argument on the stack. Instead, it evaluates the argument multiple times during IR generation. If args contains side-effects (e.g., modifying state, emitting events, or calling external contracts), those side-effects will be executed multiple times, potentially leading to unexpected behavior.

Technical Flow:

1. A Vyper contract calls create_from_blueprint(blueprint, args, raw_args=True).
2. The compiler generates IR code that evaluates args multiple times.
3. Each evaluation triggers the side-effects of args, leading to double execution.

Example Scenario:

# Vulnerable contract
@external
def deploy_with_side_effect():
    counter: uint256 = self.counter
    self.counter += 1
    create_from_blueprint(my_blueprint, [counter], raw_args=True)

In this case, counter is evaluated twice, so the new contract receives an incorrect value.

Vulnerable vs. Patched Code

Vulnerable Code (Vyper <= 0.3.10):

# In the compiler's IR generation for create_from_blueprint
# The args argument is not cached
def _build_create_IR(args):
    # args is evaluated multiple times
    for _ in range(2):
        process(args)  # Side-effects occur twice

Patched Code (Hypothetical Fix):

# Cache the args argument to prevent double evaluation
def _build_create_IR(args):
    cached_args = args  # Evaluate once and store
    for _ in range(2):
        process(cached_args)  # Use cached value

No official patch exists, but developers should manually cache arguments before passing them to create_from_blueprint.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to craft a Vyper contract that uses create_from_blueprint with raw_args=True and an args parameter that has side-effects. The attacker could then deploy the contract and trigger the double evaluation to manipulate state.

Lab Setup:

1. Install Vyper 0.3.10: pip install vyper==0.3.10
2. Create a vulnerable contract:

# vulnerable.vy
@external
def deploy(blueprint: address, value: uint256) -> address:
    return create_from_blueprint(blueprint, [self.modify_state(value)], raw_args=True)

@internal
def modify_state(value: uint256) -> uint256:
    self.stored_value += value
    return self.stored_value

3. Compile and deploy the contract.
4. Call deploy with a blueprint and observe that modify_state is called twice.

Blue Team

Detection of exploitation attempts requires monitoring for unusual contract deployments and state changes. Since the vulnerability is in the compiler, runtime detection is challenging. Focus on:

• Monitoring for contracts that use create_from_blueprint with raw_args=True.
• Auditing contract bytecode for double evaluation patterns.
• Using static analysis tools to detect side-effect arguments.

Indicators of Compromise (IOCs)

• Contract Bytecode: Contracts compiled with Vyper <= 0.3.10 that contain create_from_blueprint with raw_args=True.
• Transaction Patterns: Transactions where create_from_blueprint is called with arguments that modify state (e.g., incrementing counters, emitting events).
• Logs: Unusual event emissions or state changes during contract deployment.

Detection Engineering

YARA Rule

rule CVE_2024_32647_Vyper_Double_Eval {
    meta:
        description = "Detects Vyper contracts compiled with vulnerable create_from_blueprint"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-32647"
    strings:
        $create_blueprint = "create_from_blueprint" ascii wide nocase
        $raw_args = "raw_args" ascii wide nocase
        $double_eval = { 6a 01 5b 6a 02 5b }  // Hypothetical bytecode pattern
    condition:
        $create_blueprint and $raw_args and #double_eval > 0
}

Sigma Rule

title: CVE-2024-32647 Vyper Double Evaluation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects transactions involving Vyper contracts with double evaluation vulnerability
author: Valters IT
logsource:
    category: blockchain
    product: ethereum
detection:
    selection:
        contract_bytecode|contains: 'create_from_blueprint'
        raw_args_flag: true
    condition: selection
falsepositives:
    - Legitimate use of raw_args without side-effects
level: medium

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-32647 Vyper Double Evaluation"; content:"create_from_blueprint"; content:"raw_args"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

• Manually cache arguments before passing them to create_from_blueprint with raw_args=True.
• Avoid using side-effect arguments in create_from_blueprint calls.
• Upgrade to a patched version when available.

Long-term Fix:

• The Vyper team should patch the compiler to cache the args argument in _build_create_IR.
• Developers should use static analysis tools to detect double evaluation patterns.

Workaround:

@external
def safe_deploy(blueprint: address, value: uint256) -> address:
    cached_value: uint256 = self.modify_state(value)  # Cache side-effect
    return create_from_blueprint(blueprint, [cached_value], raw_args=True)

Valters IT
Securing the Future of Smart Contracts