Vyperlang Vyper vulnerabilities

CVE-2024-24560 [MEDIUM] CWE-119 CVE-2024-24560: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. When calls to external contracts are made, we write the input buffer starting at byte 28, and allocate the return buffer to start at byte 0 (overlapping with the input buffer). When checking RETURNDATASIZE for dynamic types, the size is compared only to the minimum allowed

CVE-2024-32645 [MEDIUM] CWE-20 CVE-2024-32645: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect values can be logged when `raw_log` builtin is called with memory or storage arguments to be used as topics. A contract search was performed and no vulnerable contracts were found in production. The `build_IR` function of the `RawLog`

CVE-2024-24564 [MEDIUM] CWE-125 CVE-2024-24564: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-i Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.

CVE-2023-42441 [MEDIUM] CWE-833 CVE-2023-42441: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in vers Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string.

CVE-2023-40015 [MEDIUM] CWE-670 CVE-2023-40015: Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of exp Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, |, &, ^ (bitwise operators), bitwise_or (deprecated), bitwise_and (deprecated), bitwise_xor (depre

CVE-2021-48019 [MEDIUM] CWE-805 CVE-2021-48019: Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such a

CVE-2026-114118 [MEDIUM] CWE-681 CVE-2026-114118: Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint25 Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially tra

CVE-2021-41122 [MEDIUM] CWE-682 CVE-2021-41122: Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly validate the bounds of decimal arguments. The can lead to logic errors. This issue has been resolved in version 0.3.0.

CVE-2020-37288 [LOW] CWE-670 CVE-2020-37288: Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop i Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contr

CVE-2026-114115 [LOW] CWE-843 CVE-2026-114115: Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that rea Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

CVE-2020-37289 [LOW] CWE-20 CVE-2020-37289: Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as E Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.

CVE-2025-47774 [LOW] CWE-691 CVE-2025-47774: Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and i Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The resul

CVE-2025-47285 [LOW] CWE-691 CVE-2025-47285: Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and i Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be v