Vyperlang Vyper vulnerabilities

CVE-2024-24563 [CRITICAL] CWE-129 CVE-2024-24563: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Arrays can be keyed by a signed integer, while they are defined for unsigned integers only. The typechecker doesn't throw when spotting the usage of an `int` as an index for an array. The typechecker allows the usage of signed integers to be used as indexes to arrays. Th

CVE-2024-22419 [CRITICAL] CWE-120 CVE-2024-22419: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn't properly adhere to the API of copy functions (for `>=0.3.2` the `copy_bytes` f

CVE-2024-24561 [CRITICAL] CWE-119 CVE-2024-24561: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for a

CVE-2022-24788 [CRITICAL] CWE-120 CVE-2022-24788: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prio Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There

CVE-2023-31146 [CRITICAL] CWE-787 CVE-2023-31146: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8 Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call fr

CVE-2025-27105 [CRITICAL] CWE-787 CVE-2025-27105: vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the writ

CVE-2022-24845 [CRITICAL] CWE-190 CVE-2022-24845: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In affected versions, the return of `.returns_int128()` is not validated to fall within the bounds of `int128`. This issue can result in a misinterpretation of the integer value and lead to incorrect behavior. As of v0.3.0, `.returns_int128()` is validated in simple expre

CVE-2021-41121 [HIGH] CWE-119 CVE-2021-41121: Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a func Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions when performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack. This issue has been resolved in version 0.3.0.

CVE-2026-114663 [HIGH] CWE-706 CVE-2026-114663: Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from im Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, includ

CVE-2021-48018 [HIGH] CWE-787 CVE-2021-48018: Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the sa Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.

CVE-2023-42443 [HIGH] CWE-787 CVE-2023-42443: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub

CVE-2025-21607 [HIGH] CWE-670 CVE-2025-21607: Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompile Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorr

CVE-2025-26622 [HIGH] CWE-682 CVE-2025-26622: vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed and a fix is expected in version 0.4.1. Users are advi

CVE-2023-32059 [HIGH] CWE-683 CVE-2023-32059: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8 Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The abilit

CVE-2022-29255 [HIGH] CWE-670 CVE-2022-29255: Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0 Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return value, the contract address (including side effects) could be evaluated twice. This may result in incorrect outcomes for contracts. This issue has been addressed in v0.3.4.

CVE-2022-24787 [HIGH] CWE-697 CVE-2022-24787: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and p Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one ends with `"\x00"` because there is no comparison of the l

CVE-2021-48020 [MEDIUM] CWE-787 CVE-2021-48020: Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect st Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract be

CVE-2023-32058 [HIGH] CWE-190 CVE-2023-32058: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8 Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for

CVE-2023-30629 [HIGH] CWE-670 CVE-2023-30629: Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 thro Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `

CVE-2023-30837 [HIGH] CWE-789 CVE-2023-30837: Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard agains Vyper is a pythonic smart contract language for the EVM. The storage allocator does not guard against allocation overflows in versions prior to 0.3.8. An attacker can overwrite the owner variable. This issue was fixed in version 0.3.8.