CVE-2024-24559: 
Python vulnerability analysis and mitigation

Vyper, a Pythonic Smart Contract Language for the EVM, contains a stack management error when compiling the IR for sha3_64. The vulnerability was discovered and disclosed on February 5, 2024, affecting Vyper versions <=0.3.10, with a patch available in version 0.4.0 (GitHub Advisory).

The vulnerability stems from an error in height variable calculation during IR compilation for sha3_64. Specifically, after compiling the 0th argument, the height variable isn't increased correctly. While withargs defined in the inner scope are manipulated correctly due to both their height and global height being off, this leads to incorrect stack placement calculations (GitHub Advisory).

The vulnerability's impact is considered low as it cannot be triggered through regular Vyper code compilation. The issue only manifests when using the fang binary (formerly called vyper-ir prior to v0.3.4) directly with hand-written IR code (GitHub Advisory).

The vulnerability has been patched in Vyper version 0.4.0 through pull request #4063. Users should upgrade to this version or newer to receive the fix (GitHub Advisory).