CVE-2026-114663

A flaw was found in Vyper. The compiler incorrectly resolves imported constants and default arguments within a function's local scope rather than at their original declaration. If a smart contract uses a local variable or parameter that shares a name with an imported identifier, an attacker...

CVE-2026-114663

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

EUVD-2026-107698

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663

Vyper versions 0.4.0b1 through 0.5.0b1 are vulnerable to a name shadowing issue affecting unfoldable constants and omitted default arguments from imported modules. The root cause is that the parse_Name function resolves these names within the using function's scope instead of at the point of decl...

CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114663

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

PT-2026-120945

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...

CVE-2026-114114

A flaw was found in Vyper. The compiler improperly calculates source code positions by mixing character-based offsets with byte offsets during parsing. An attacker contributing source code can exploit this flaw by introducing multi-byte characters or invisible markers to shift internal code...

CVE-2026-114118

A flaw was found in Vyper. When deploying smart contracts from blueprints reusable contract templates, the createfromblueprint function calculates remaining code size without verifying that the offset is within the template boundaries, causing an integer calculation error. A remote attacker...

CVE-2026-114117

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

CVE-2026-114118

Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in createfromblueprint by uint256 subtraction without first checking that codeoffset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling codeoffset can make a factory deploy...

CVE-2026-114114

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte coloffset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with...

CVE-2026-114115

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parseIfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

CVE-2026-114116

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines, which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing...

CVE-2021-48020

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can...

CVE-2021-48019

Vyper before 0.2.9 deploys forwarder proxies through the built-in createforwarderto function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data...

CVE-2020-37288

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination stack underflow. Affected contracts revert such calls unnecessarily, which in limited...

CVE-2020-37286

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can...

CVE-2020-37287

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the...

CVE-2020-37289

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals, to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values...