CVE-2024-24561

The slice() function applies a bounds checking mechanism, however it does not account for situations where the sum of the start and length arguments can undergo arithmetic overflow (integer overflow) if they are not literal values. An attacker can pass appropriately crafted dynamic values that cause overflow and bypass range verification. This results in the ability to perform out-of-bounds (OOB) read or write operations in storage, memory, or calldata space.

An attacker can gain unauthorized access to data outside the permitted range (OOB read/write) in storage, memory, or calldata areas of the contract, and can overwrite the slot storing the array length, potentially leading to contract state corruption or privilege escalation in its logic.

Update the Vyper compiler to a version newer than 0.3.10. Detailed information about available patches is available in the project repository and the GHSA-9x7f-gwxq-6f2c security advisory. Contracts compiled with the vulnerable compiler version should be recompiled and redeployed after updating.

Vyperlang Vyper version 0.3.10 and earlier — affects smart contracts compiled with this compiler that use the slice() function with non-literal start or length arguments.