CVE-2024-24560

Summary

CVE-2024-24560 is a vulnerability affecting Vyper, a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The issue arises from the way input and return buffers are handled in the language. Specifically, when calling external contracts, Vyper writes the input buffer starting at byte 28 and allocates the return buffer to start at byte 0, resulting in an overlap between the two. However, when checking RETURNDATASIZE for dynamic types, Vyper only compares the size to the minimum allowed size for that type, rather than the actual length of the returned data. Consequently, malformed return data from the called contract can cause the calling contract to read incorrect data from the overlapping buffer, leading to potential security vulnerabilities.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.