CVE-2024-32649: 
Python vulnerability analysis and mitigation

Vyper, a pythonic Smart Contract Language for the Ethereum virtual machine, was found to contain a vulnerability (CVE-2024-32649) in versions 0.3.10 and prior. The vulnerability involves the sqrt builtin function, which can result in double evaluation of arguments when they have side-effects. This issue was discovered and disclosed in April 2024 (GitHub Advisory).

The vulnerability stems from the build_IR function of the sqrt builtin not caching the argument to the stack. As a result, arguments can be evaluated multiple times instead of retrieving the value from the stack. The issue became more difficult to trigger after version 0.3.4 with the introduction of the unique symbol fence. The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The impact of this vulnerability is considered low. No vulnerable production contracts were found during security assessments. Additionally, double evaluation of side-effects should be easily discoverable in client tests (GitHub Advisory).

The vulnerability can be triggered when using the sqrt builtin with arguments that have side-effects. A proof of concept demonstrates that when calling the sqrt function with an argument that modifies contract state, the state-modifying code can be executed multiple times instead of once as expected (GitHub Advisory).

As of the time of publication, no fixed versions were available. The issue was later patched in version 0.4.0 through pull request #3976 (GitHub Advisory).