CVE-2024-24567: Vyperlang Vyper Value Handling Vulnerability

CVE-2024-24567 Overview

CVE-2024-24567 affects the Vyper smart contract language compiler for the Ethereum Virtual Machine (EVM). The compiler accepts a value= keyword argument in the built-in raw_call function even when the call uses delegatecall or staticcall semantics. The EVM opcodes underlying these call types do not support a value transfer, so the compiler silently discards the argument. Developers who assume the value parameter functions consistently across call modes can write contracts that behave differently than intended. All Vyper releases up to and including 0.3.10 are affected.

Critical Impact
Contracts relying on value= semantics with delegatecall or staticcall may execute without the expected value transfer, producing incorrect on-chain behavior and potential financial logic errors.

Affected Products

Vyperlang Vyper 0.3.10
All prior Vyper releases through 0.3.10
Smart contracts compiled with affected Vyper versions using raw_call with delegatecall or staticcall

Discovery Timeline

2024-01-30 - CVE-2024-24567 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24567

Vulnerability Analysis

Vyper is a Pythonic smart contract language that compiles to EVM bytecode. The raw_call built-in exposes low-level call primitives, including a value keyword argument that specifies the amount of Ether to forward with the call. The compiler permits value= when the call is configured as a delegatecall or staticcall, but the underlying DELEGATECALL and STATICCALL opcodes have no value field. The compiler discards the argument without emitting a warning or error.

This represents an improper handling of exceptional conditions [CWE-754]. Developers unfamiliar with EVM opcode semantics may write contracts that pass a nonzero value expecting the transfer to occur. The contract compiles cleanly, deploys, and executes without reverting, but no Ether moves. This can lead to accounting inconsistencies, broken payment flows, or logic bugs that adversaries can leverage against dependent protocols.

Root Cause

The root cause is missing validation in the Vyper compiler's raw_call handler in vyper/builtins/functions.py. The function accepts the value kwarg for all call types instead of rejecting it when is_delegate_call or is_static_call is set. Because DELEGATECALL and STATICCALL do not carry a value word on the EVM stack, the compiler emits bytecode that ignores the argument entirely.

Attack Vector

The issue is a developer-facing correctness bug rather than a direct memory safety flaw. An attacker cannot inject the condition, but can exploit contracts that depend on incorrect assumptions about value transfer with delegatecall or staticcall. Where financial logic branches on a transfer succeeding, this mismatch can be leveraged to manipulate contract state. Reference the GitHub Security Advisory GHSA-x2c2-q32w-4w6m and the affected functions.py source for compiler-level details.

Detection Methods for CVE-2024-24567

Indicators of Compromise

Deployed contracts compiled with Vyper 0.3.10 or earlier that call raw_call with both value= and is_delegate_call=True or is_static_call=True
Transaction traces showing DELEGATECALL or STATICCALL opcodes originating from Vyper-compiled contracts where developers expected value transfer
Application-level accounting discrepancies between recorded transfers and on-chain balances

Detection Strategies

Perform source code review of all Vyper contracts to identify raw_call invocations that combine value= with is_delegate_call=True or is_static_call=True
Recompile contracts with a patched Vyper version and compare emitted bytecode against production deployments
Run automated static analysis over Vyper source repositories to flag the vulnerable call pattern

Monitoring Recommendations

Track compiler versions used in CI/CD pipelines and block builds using Vyper releases at or below 0.3.10 for new deployments
Monitor smart contract auditing tools and dependency scanners for advisories referencing GHSA-x2c2-q32w-4w6m
Log and review any on-chain calls where Vyper contracts execute DELEGATECALL or STATICCALL against untrusted targets

How to Mitigate CVE-2024-24567

Immediate Actions Required

Upgrade Vyper to a version later than 0.3.10 that enforces validation on the value argument in raw_call
Audit all raw_call usages in existing Vyper source and remove value= when is_delegate_call or is_static_call is set
Recompile and redeploy affected contracts, or wrap them with proxy logic that enforces correct behavior when redeployment is not feasible

Patch Information

The Vyper maintainers documented the issue in GitHub Security Advisory GHSA-x2c2-q32w-4w6m. The fix updates the compiler to reject the value argument when the call type does not support value transfer. Consumers should pin CI/CD toolchains to a patched Vyper release and rebuild affected artifacts.

Workarounds

Manually omit value= from raw_call when is_delegate_call=True or is_static_call=True and add unit tests that assert the intended transfer behavior
Introduce lint rules or pre-commit hooks that reject the vulnerable pattern in Vyper source files
Isolate untrusted targets behind wrapper contracts that validate call configuration before dispatching

bash

# Upgrade Vyper to a patched release
pip install --upgrade "vyper>0.3.10"

# Verify installed compiler version
vyper --version