CVE-2024-24560 Overview
CVE-2024-24560 affects Vyper, a Pythonic smart contract language for the Ethereum Virtual Machine (EVM). The vulnerability stems from how Vyper handles external contract call buffers. The compiler writes the input buffer starting at byte 28 and allocates the return buffer at byte 0, causing the two buffers to overlap. When checking RETURNDATASIZE for dynamic types, the compiler only compares against the minimum allowed size rather than the actual returned length. A called contract returning malformed ABIv2-encoded data can cause the caller to interpret leftover input buffer bytes as returndata, producing incorrect values at the calling contract.
Critical Impact
Calling contracts can read attacker-influenced data from a dirty overlapping buffer instead of valid returndata, breaking downstream smart contract logic.
Affected Products
- Vyperlang Vyper (Python-distributed compiler)
- Smart contracts compiled with vulnerable Vyper versions
- EVM-deployed contracts performing external calls with dynamic return types
Discovery Timeline
- 2024-02-02 - CVE-2024-24560 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-24560
Vulnerability Analysis
The vulnerability is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Vyper's compiler emits code that places the input buffer for external calls starting at memory byte 28. The return buffer begins at byte 0, so the two regions overlap by design to save memory. After the call returns, Vyper validates the length of dynamic return types against a static minimum rather than the actual RETURNDATASIZE. A malicious or buggy callee can return a shorter payload than expected, leaving residual input-buffer bytes within the region the caller treats as returndata.
The caller then decodes stale bytes as if they were part of the ABIv2-encoded response. This produces return values that differ from what the called contract actually returned, undermining the integrity of inter-contract communication.
Root Cause
The root cause is incorrect bounds checking on dynamic return types combined with an overlapping input and return buffer layout. The compiler assumes well-formed ABIv2 encoding and omits a check comparing RETURNDATASIZE against the full declared length of the returned object.
Attack Vector
An attacker-controlled external contract returns malformed ABIv2 data whose declared length exceeds the actual returndata size. The calling contract reads beyond the real returndata into the dirty input buffer region. The attacker influences those bytes by controlling the call arguments the caller passes to the external function.
No verified public proof-of-concept code is published. See the Vyper security advisory GHSA-gp3w-2v2m-p686 for the maintainer's technical description.
Detection Methods for CVE-2024-24560
Indicators of Compromise
- Deployed contracts compiled with Vyper versions prior to the fix identified in the vendor advisory.
- Unexpected or inconsistent return values from external calls to untrusted contracts that use dynamic ABIv2 return types.
- On-chain traces showing callees that return RETURNDATASIZE values smaller than the declared ABI length.
Detection Strategies
- Audit Vyper source code for external calls that return dynamic types such as bytes, string, or dynamic arrays.
- Inspect compiled bytecode for returndata length validations that compare against minimum sizes rather than actual size.
- Review the dependency manifest for Vyper compiler versions matching the advisory's vulnerable range.
Monitoring Recommendations
- Monitor transaction traces for external calls to untrusted addresses with dynamic return types.
- Track revert patterns and unexpected state transitions that could indicate decoded garbage data.
- Ingest smart contract build metadata into a security data lake to flag deployments produced by vulnerable compiler versions.
How to Mitigate CVE-2024-24560
Immediate Actions Required
- Upgrade the Vyper compiler to the fixed version referenced in GHSA-gp3w-2v2m-p686 and recompile affected contracts.
- Redeploy contracts that make external calls returning dynamic ABIv2 types after recompilation.
- Inventory all production contracts and map them to the Vyper compiler version used at build time.
Patch Information
The Vyper maintainers published the fix and advisory details at GHSA-gp3w-2v2m-p686. The patch adjusts the returndata size validation so that the actual RETURNDATASIZE is compared against the full declared length of dynamic return types.
Workarounds
- Avoid external calls that return dynamic ABIv2 types when the callee is untrusted.
- Wrap vulnerable external calls in assembly that explicitly validates RETURNDATASIZE before decoding.
- Replace dynamic return types with fixed-size types where feasible until recompilation with the patched compiler is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
