CVE-2024-26149 Information

Description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in _abi_decode it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds potentially leading to exploitations in contracts that use arrays within _abi_decode. This vulnerability affects 0.3.10 and earlier versions.

Reference

https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w