CVE-2024-24559: Vyperlang Vyper Stack Management Vulnerability

CVE-2024-24559 is a stack management flaw in Vyperlang Vyper affecting sha3_64 IR compilation. The vulnerability requires manual IR writing to trigger and cannot be exploited through regular Vyper code. This article covers technical details, affected versions, impact assessment, and available mitigation strategies.

CVE-2024-24559 Overview

CVE-2024-24559 affects Vyper, a Pythonic smart contract language for the Ethereum Virtual Machine (EVM). The vulnerability stems from an error in stack management when compiling the intermediate representation (IR) for sha3_64. The height variable is miscalculated during compilation. The flaw cannot be triggered from regular Vyper source code and requires an attacker to hand-write the IR directly. Because sha3_64 is used for mapping retrieval and no flow caches the key, compiler-generated IR does not reach the vulnerable path. The practical impact on normal Vyper development workflows is low. At the time of publication, no patch is available.

Critical Impact
Hand-written IR using sha3_64 triggers incorrect stack height tracking in the Vyper compiler, which can produce malformed bytecode. The issue is not reachable through standard Vyper source code.

Affected Products

Vyperlang Vyper (Python package)
Vyper IR compilation pipeline (vyper/ir/compile_ir.py)
Smart contracts compiled from hand-written IR using sha3_64

Discovery Timeline

2024-02-05 - CVE-2024-24559 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24559

Vulnerability Analysis

The defect resides in the Vyper IR compiler, specifically in the stack management logic for the sha3_64 opcode. During IR compilation, the compiler tracks a height variable that represents the current EVM stack depth. For sha3_64, this value is miscalculated. The miscalculation produces incorrect stack references in subsequent emitted bytecode. The underlying weakness is categorized under [CWE-327: Use of a Broken or Risky Cryptographic Algorithm], reflecting the role sha3_64 plays in keyed hashing for storage mappings. Vyper's standard code generation never exercises the faulty path because mapping key caching flows do not route through this logic. The issue therefore requires an attacker who authors raw IR, which is not an input accepted from untrusted sources in normal smart contract development.

Root Cause

The root cause is an off-by-one or similar accounting error in the height variable within the sha3_64 compilation handler at vyper/ir/compile_ir.py lines 585-586. The compiler fails to correctly reflect stack items consumed and produced by the operation. See the GitHub Vyper Compilation Code for the affected lines.

Attack Vector

An attacker must supply hand-written Vyper IR that uses sha3_64 to a Vyper compilation pipeline. Standard high-level Vyper source does not generate this pattern. Exploitation would require convincing a developer or build system to compile untrusted IR. The resulting bytecode could contain incorrect stack references, producing contracts with unintended runtime behavior.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-6845 for the full technical description.

Detection Methods for CVE-2024-24559

Indicators of Compromise

Build artifacts produced from hand-written IR files containing sha3_64 operations rather than from .vy source
Deployed EVM bytecode whose runtime behavior diverges from the intended mapping lookup semantics
Unexplained stack-related reverts in contracts compiled through non-standard IR pipelines

Detection Strategies

Audit all Vyper build pipelines to confirm they compile only .vy source files and not raw IR inputs
Search source repositories for raw IR files or build scripts invoking the Vyper IR frontend directly
Review contract bytecode produced by custom tooling against bytecode produced by the standard Vyper source compiler

Monitoring Recommendations

Monitor CI/CD systems for unexpected invocations of Vyper IR compilation modes
Track versions of Vyper used across projects and compare against the vendor security advisory
Log and review developer workflows that bypass the standard Vyper source-to-bytecode pipeline

How to Mitigate CVE-2024-24559

Immediate Actions Required

Prohibit hand-written IR as input to Vyper build pipelines; compile only from .vy source
Inventory all Vyper projects and identify any use of raw IR or custom IR generators
Subscribe to the Vyper GitHub security advisories to receive patch availability notifications

Patch Information

At the time of CVE publication, no patch was available from the vendor. Monitor the GitHub Security Advisory GHSA-6845 for updates and apply the fix once released. Because the issue cannot be reached from standard Vyper source, the vendor assessed the impact as low.

Workarounds

Restrict Vyper compilation inputs to .vy source files only and reject raw IR submissions
Review and remove any internal tooling that generates or compiles hand-written Vyper IR using sha3_64
Perform bytecode-level diffing between standard-compiled contracts and any contracts produced from alternative pipelines
Apply code review controls requiring approval for changes to the smart contract build toolchain

bash

# Configuration example: restrict build pipeline to .vy source only
# Reject any non-source inputs in CI
find ./contracts -type f ! -name '*.vy' -print | grep . && exit 1
vyper ./contracts/MyContract.vy -o ./build/MyContract.bin