CVE-2024-24564 — Vyper extract32 can ready dirty memory
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to…
Published: 2024-02-26 · CVSS: 3.7 · CVSS 3.1
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7