Skip to main content

Improper Input Validation

CVE-2024-32645

Medium
5.3/10

Summary

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In vyper package, incorrect values can be logged when the `raw_log` built in is called with memory or storage arguments to be used as topics. A contract search was performed, and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog` class fails to properly unwrap the variables provided as topics. Consequently, incorrect values are logged as topics. As of time of publication, no fixed version is available. This issue affects versions prior to v0.4.0rc4.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-20 - Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

Advisory Timeline

  • Published