cve/2024/CVE-2024-24559.md

### [CVE-2024-24559](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24559)
![](https://img.shields.io/static/v1?label=Product&message=vyper&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%3D%200.3.10%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-327%3A%20Use%20of%20a%20Broken%20or%20Risky%20Cryptographic%20Algorithm&color=brighgreen)

### Description

Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writing the `IR` by hand (that is, it cannot be triggered from regular vyper code). `sha3_64` is used for retrieval in mappings. No flow that would cache the `key` was found so the issue shouldn't be possible to trigger when compiling the compiler-generated `IR`. This issue isn't triggered during normal compilation of vyper code so the impact is low. At the time of publication there is no patch available.

### POC

#### Reference
- https://github.com/vyperlang/vyper/security/advisories/GHSA-6845-xw22-ffxv

#### Github
No PoCs found on GitHub currently.