Skip to content
OpenAdvisories
Medium · 4.8 CVE-2024-24567 EUVD-2024-0178GHSA-x2c2-q32w-4w6mPYSEC-2024-151

raw_call `value=` kwargs not disabled for static and delegate calls

Published Jan 30, 2024 · Updated Jun 16, 2025 · Assigned by GitHub_M

Description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently ignore the value= argument. If the semantics of the EVM are unknown to the developer, he could suspect that by specifying the `value` kwarg, exactly the given amount will be sent along to the target. This vulnerability affects 0.3.10 and earlier versions.

Affected products

VendorProductAffectedFixed
vyperlang vyper <= 0.3.10 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI vyper < 0.4.0 0.4.0 GHSA-x2c2-q32w-4w6m
PyPI vyper < 0.4.0b1 0.4.0b1 PYSEC-2024-151

References