Vyperlang Vyper vulnerabilities

CVE-2023-39363 [MEDIUM] CWE-863 CVE-2023-39363: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2. Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A

CVE-2024-32647 [MEDIUM] CWE-95 CVE-2024-32647: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `create_from_blueprint` builtin can result in a double eval vulnerability when `raw_args=True` and the `args` argument has side-effects. It can be seen that the `_build_create_IR` function of the `create_from_blueprint` builtin doesn'

CVE-2024-32646 [MEDIUM] CWE-20 CVE-2024-32646: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `slice` builtin can result in a double eval vulnerability when the buffer argument is either `msg.data`, `self.code` or `.code` and either the `start` or `length` arguments have side-effects. It can be easily triggered only with the v

CVE-2023-37902 [MEDIUM] CWE-252 CVE-2023-37902: Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to v Vyper is a Pythonic programming language that targets the Ethereum Virtual Machine (EVM). Prior to version 0.3.10, the ecrecover precompile does not fill the output buffer if the signature does not verify. However, the ecrecover builtin will still return whatever is at memory location 0. This means that the if the compiler has been convinced to writ

CVE-2024-24567 [MEDIUM] CWE-754 CVE-2024-24567: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in builtin raw_call even if the call is a delegatecall or a staticcall. But in the context of delegatecall and staticcall the handling of value is not possible due to the semantics of the respective opcodes, and vyper will silently igno

CVE-2024-32649 [MEDIUM] CWE-95 CVE-2024-32649: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `sqrt` builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the `build_IR` function of the `sqrt` builtin doesn't cache the argument to the stack. As such, it can be evaluated multipl

CVE-2024-32648 [MEDIUM] CWE-667 CVE-2024-32648: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0 Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a `default` function is a very sparsely used pattern. As such, the impact is low. Version 0.3

CVE-2024-32481 [MEDIUM] CWE-681 CVE-2024-32481: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0. Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range

CVE-2023-32675 [MEDIUM] CWE-670 CVE-2023-32675: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the remova

CVE-2024-26149 [MEDIUM] CWE-119 CVE-2024-26149: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively larg Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use

CVE-2024-32645 [MEDIUM] CWE-20 CVE-2024-32645: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog`

CVE-2024-24559 [MEDIUM] CWE-327 CVE-2024-24559: Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management w Vyper is a Pythonic Smart Contract Language for the EVM. There is an error in the stack management when compiling the `IR` for `sha3_64`. Concretely, the `height` variable is miscalculated. The vulnerability can't be triggered without writing the `IR` by hand (that is, it cannot be triggered from regular vyper code). `sha3_64` is used for retrieval

CVE-2024-24560 [MEDIUM] CWE-119 CVE-2024-24560: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0 (overlapping with the input buffer). When checking RETURNDATASIZE for dynamic types, the size is compared only to the minimum allowed

CVE-2023-41052 [MEDIUM] CWE-670 CVE-2023-41052: Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arg Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A pat

CVE-2024-24564 [MEDIUM] CWE-125 CVE-2024-24564: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-i Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.

CVE-2023-42441 [MEDIUM] CWE-833 CVE-2023-42441: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in vers Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.

CVE-2023-40015 [MEDIUM] CWE-670 CVE-2023-40015: Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of exp Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, |, &, ^ (bitwise operators), bitwise_or (deprecated), bitwise_and (deprecated), bitwise_xor (depre

CVE-2021-41122 [MEDIUM] CWE-682 CVE-2021-41122: Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The can lead to logic errors. This issue has been resolved in version 0.3.0.

CVE-2025-47774 [LOW] CWE-691 CVE-2025-47774: Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and i Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The resul

CVE-2025-47285 [LOW] CWE-691 CVE-2025-47285: Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and i Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be v