CVE-2024-24564: Vyperlang Vyper Buffer Overflow Vulnerability

CVE-2024-24564 Overview

CVE-2024-24564 affects Vyper, a Pythonic smart contract language for the Ethereum Virtual Machine (EVM). The vulnerability resides in the built-in extract32(b, start) function. When the start index expression has a side effect that modifies b, the compiler can emit code that reads dirty memory. As a result, extract32 may return bytes that do not correspond to the intended source data. The issue is classified as an out-of-bounds read [CWE-125] and is fixed in Vyper 0.4.0. Smart contracts compiled with vulnerable Vyper releases may expose unintended on-chain data to callers.

Critical Impact
Smart contracts using extract32 with side-effecting index expressions can return attacker-influenced or uninitialized memory, breaking data integrity assumptions for callers and downstream contracts.

Affected Products

Vyperlang Vyper versions prior to 0.4.0
Smart contracts compiled with vulnerable Vyper releases that invoke extract32
EVM-targeted applications depending on Vyper bytecode generation

Discovery Timeline

2024-02-26 - CVE-2024-24564 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24564

Vulnerability Analysis

The extract32(b, start) built-in extracts a 32-byte word from byte array b starting at offset start. The code generator evaluates the two arguments without accounting for evaluation-order side effects. When start is an expression that mutates b (for example, a call that overwrites the same memory region), the evaluation can leave the byte array in a modified state before the extraction logic reads from it. The read then returns bytes that the developer did not intend to expose. Because EVM memory is zero-initialized and reused across operations, the returned slice may contain stale or attacker-controlled values from earlier computations.

Root Cause

The root cause is a code generation flaw in the Vyper compiler. The extract32 built-in did not detect potential overlap between the memory region referenced by b and the memory touched while evaluating start. Without this overlap check, the compiler emitted a non-atomic sequence that mixed evaluation and read-back of the same buffer.

Attack Vector

Exploitation requires a contract author to use extract32 with a start expression that writes to the same byte array passed as b. An attacker who can influence inputs to such a contract function may trigger disclosure of unintended memory contents through the extracted word. The impact is limited to information integrity for the extracted bytes and does not grant code execution on the chain.

python

     get_type_for_exact_size,
     ir_tuple_from_args,
     make_setter,
+    potential_overlap,
     promote_signed_int,
     sar,
     shl,
# Source: https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f
# The patch imports a new potential_overlap helper used in builtins/functions.py
# to detect when argument evaluation could alias the source buffer and panic
# at compile time instead of emitting unsafe memory reads.

Detection Methods for CVE-2024-24564

Indicators of Compromise

Deployed contracts compiled with Vyper versions earlier than 0.4.0 that import or call extract32
Contract source using extract32(b, start) where start is a function call, assignment, or expression that writes into b
Compiler build logs showing Vyper releases without the potential_overlap helper introduced in commit 3d9c537

Detection Strategies

Perform static analysis of Vyper source trees for all call sites of extract32 and flag arguments where start is not a pure expression.
Enumerate on-chain deployments and correlate bytecode metadata with Vyper compiler versions prior to 0.4.0.
Add CI checks that fail builds using Vyper releases listed in GitHub Security Advisory GHSA-4hwq-4cpm-8vmx.

Monitoring Recommendations

Track dependency manifests (requirements.txt, pyproject.toml, Hardhat/Foundry Vyper plugins) for pinned Vyper versions below 0.4.0.
Review contract audit reports for any note regarding extract32 usage and re-audit affected modules after upgrading.
Subscribe to the Vyper GitHub security advisories feed to catch related code generation issues.

How to Mitigate CVE-2024-24564

Immediate Actions Required

Upgrade the Vyper compiler to version 0.4.0 or later and recompile all affected contracts.
Audit all usages of extract32 and rewrite call sites so that the start argument is a simple, side-effect-free expression.
For deployed contracts that cannot be upgraded, evaluate whether extract32 outputs feed security-sensitive logic and plan contract migration where needed.

Patch Information

The fix is delivered in Vyper 0.4.0. The underlying code generation change is in commit 3d9c537142fb99b2672f21e2057f5f202cde194f, which introduces the potential_overlap helper used by builtins/functions.py to detect aliasing between built-in arguments and panic at compile time. See the GitHub Security Advisory GHSA-4hwq-4cpm-8vmx for full remediation guidance.

Workarounds

Precompute the start index into a local variable before calling extract32, ensuring no side effects occur during the built-in call.
Avoid passing function calls that mutate the source byte array as the start argument.
Replace extract32 with manual slicing patterns that explicitly order operations until the compiler can be upgraded.

bash

# Pin a fixed Vyper release in your Python environment
pip install "vyper>=0.4.0"

# Verify the installed compiler version
vyper --version