Vyperlang Vyper vulnerabilities

CVE-2023-46247 [HIGH] CWE-193 CVE-2023-46247: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts contai Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Contracts containing large arrays might underallocate the number of slots they need by 1. Prior to v0.3.8, the calculation to determine how many slots a storage variable needed used `math.ceil(type_.size_in_bytes / 32)`. The intermediate floating point step can produce

CVE-2023-42460 [HIGH] CWE-682 CVE-2023-42460: Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not valid Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release `0.3.10`. Users a

CVE-2025-27104 [HIGH] CWE-662 CVE-2025-27104: vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body (e.g. read a storage variable updated in the loop body) and thus lead to unexpected prog

CVE-2020-37286 [MEDIUM] CWE-787 CVE-2020-37286: Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect st Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to exter

CVE-2020-37287 [MEDIUM] CWE-131 CVE-2020-37287: Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function out Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.

CVE-2023-39363 [MEDIUM] CWE-863 CVE-2023-39363: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2. Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A

CVE-2026-114117 [MEDIUM] CWE-682 CVE-2026-114117: Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(ms Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, re

CVE-2024-32646 [MEDIUM] CWE-20 CVE-2024-32646: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the v

CVE-2023-37902 [MEDIUM] CWE-252 CVE-2023-37902: Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to v Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that the if the compiler has been convinced to writ

CVE-2024-24567 [MEDIUM] CWE-754 CVE-2024-24567: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently igno

CVE-2024-32647 [MEDIUM] CWE-95 CVE-2024-32647: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn'

CVE-2024-32649 [MEDIUM] CWE-95 CVE-2024-32649: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack. As such, it can be evaluated multipl

CVE-2024-32648 [MEDIUM] CWE-667 CVE-2024-32648: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0 Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3

CVE-2026-114114 [MEDIUM] CWE-176 CVE-2026-114114: Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or

CVE-2024-32481 [MEDIUM] CWE-681 CVE-2024-32481: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0. Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range

CVE-2023-32675 [MEDIUM] CWE-670 CVE-2023-32675: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the remova

CVE-2023-41052 [MEDIUM] CWE-670 CVE-2023-41052: Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arg Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A pat

CVE-2024-24559 [MEDIUM] CWE-327 CVE-2024-24559: Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management w Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writing the `IR` by hand (that is, it cannot be triggered from regular vyper code). `sha3_64` is used for retrieval

CVE-2026-114116 [MEDIUM] CWE-436 CVE-2026-114116: Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitl Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing source code can hide these characters in comments

CVE-2024-26149 [MEDIUM] CWE-119 CVE-2024-26149: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively larg Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use