Executive brief
Vyper is a smart contract programming language for Ethereum. A vulnerability in the concat() function allows attackers to write past the allocated memory buffer, overwriting adjacent data and potentially altering contract behavior or corrupting stored values like immutables and local variables. This is a memory safety issue that can silently corrupt contract state without triggering obvious errors.
Technical details
The concat() built-in function allocates a memory buffer but incorrectly uses the copy_bytes() function to copy string/bytes arguments, which may copy entire 32-byte words even when only 1 byte is requested. When the destination buffer's remaining space is less than 32 bytes, this word-sized write overflows the buffer boundary and corrupts adjacent memory. The vulnerability is triggered primarily when concat() is called within an internal function that is invoked from an external function; the memory layout in this scenario places the internal function's data below the caller's data, allowing the overflow to corrupt the caller's local variables and immutables. Both memory and storage sources can cause the corruption. The issue affects Vyper ≤0.3.10 and was patched in 0.4.0.
Affected products
- Vyper Vyper <=0.3.10
Timeline
- 2024-01-19: disclosed
- 2024-01-19: patched: patched in Vyper 0.4.0