CVE-2024-32649 - CVE House
Back to Database
Status published Medium CVE-2024-32649

vyper performs double eval of the argument of sqrt

Vulnerability Description

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack. As such, it can be evaluated multiple times (instead of retrieving the value from the stack). No vulnerable production contracts were found. Additionally, double evaluation of side-effects should be easily discoverable in client tests. As such, the impact is low. As of time of publication, no fixed versions are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32649

Credits & Attribution

No credits recorded in the NVD database.

References

More from vyperlang

View All →
CVE-2025-47774
Vyper's `slice()` may elide side-effects when output length is 0
Low 2.9
CVE-2025-47285
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Low 2.9
CVE-2025-27105
AugAssign evaluation order causing OOB write within the object in Vyper
Low 2.3
CVE-2025-27104
double eval in For List Iter in Vyper
Low 2.3
CVE-2025-26622
sqrt doesn't define rounding behavior in Vyper
Low 2.3

Affected Vendor

Affected Software

vyper
Vulnerable Versions:
<= 0.3.10

Timeline

Official Publish: April 25th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-95

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.