PT-2026-120160

Vyper before 0.2.9 deploys forwarder proxies through the built-in create forwarder to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return dat...

PT-2026-120243

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which msg.value | K or lenmsg.data | K, where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas the default or -O codesize. Affected contracts use the wrong valu...

PT-2026-120155

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can...

PT-2026-120159

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the...

PT-2026-120241

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing...

slither

Slither, el analizador estático de contratos inteligentes Únete al Slack de Empire Hacking - Discusiones y Soporte Slither es un framework de análisis estático para Solide y Vyper escrito en Python3. Ejecuta un conjunto de detectores de vulnerabilidades, imprime información visual sobre los...

Vyper: Memory corruption using function calls within tuples / nested calls

Impact When performing a function call inside a tuple or as an argument inside another function call, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack. Example code: python @internal def fooa: uint256, b: uint256, c: uint256 - uint256,...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.5.2) +4 more potentially affected by unknown CVE via vyper (>=0.1.0b3, <=0.2.4)

vyper PYPI version =0.1.0b3, =0.1.0, =1.4.0, =0.1.3, =0.1.2b2, =0.1.2b4 Source cves: unknown CVE Source advisory: OSV:GHSA-2R3X-4MRV-MCXF...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.5.2) +4 more potentially affected by unknown CVE via vyper (>=0.1.0b3, <=0.2.4)

vyper PYPI version =0.1.0b3, =0.1.0, =1.4.0, =0.1.3, =0.1.2b2, =0.1.2b4 Source cves: unknown CVE Source advisory: GHSA-2R3X-4MRV-MCXF...

GHSA-2R3X-4MRV-MCXF Vyper: Memory corruption using function calls within tuples / nested calls

Impact When performing a function call inside a tuple or as an argument inside another function call, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack. Example code: python @internal def fooa: uint256, b: uint256, c: uint256 - uint256,...

GHSA-4V7V-GQF9-WW2G Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Impact When we pass a multi-dimensional array like 1, 2, 3, 4 as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code:...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.5.2) +4 more potentially affected by unknown CVE via vyper (>=0.1.0b3, <=0.2.4)

vyper PYPI version =0.1.0b3, =0.1.0, =1.4.0, =0.1.3, =0.1.2b2, =0.1.2b4 Source cves: unknown CVE Source advisory: OSV:GHSA-4V7V-GQF9-WW2G...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.5.2) +4 more potentially affected by unknown CVE via vyper (>=0.1.0b3, <=0.2.4)

vyper PYPI version =0.1.0b3, =0.1.0, =1.4.0, =0.1.3, =0.1.2b2, =0.1.2b4 Source cves: unknown CVE Source advisory: GHSA-4V7V-GQF9-WW2G...

Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Impact When we pass a multi-dimensional array like 1, 2, 3, 4 as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code:...

Vyper: Return inside for loop more than 1 level deep

VVE-2020-0002 Earlier today, we received a responsible disclosure of a potential issue from @michwill developer of @curvefi for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.4.2) +1 more potentially affected by unknown CVE via vyper (>=0.1.0b12, <=0.1.0b17)

vyper PYPI version =0.1.0b12, =0.1.0, =1.4.0, =1.7.1 Source cves: unknown CVE Source advisory: OSV:GHSA-VG88-3V92-RJX2...

2vyper (0.3.0), black-mamba (>=0.1.0, <=0.4.2) +1 more potentially affected by unknown CVE via vyper (>=0.1.0b12, <=0.1.0b17)

vyper PYPI version =0.1.0b12, =0.1.0, =1.4.0, =1.7.1 Source cves: unknown CVE Source advisory: GHSA-VG88-3V92-RJX2...

GHSA-VG88-3V92-RJX2 Vyper: Return inside for loop more than 1 level deep

VVE-2020-0002 Earlier today, we received a responsible disclosure of a potential issue from @michwill developer of @curvefi for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction...

PT-2026-115979

Impact When performing a function call inside a tuple or as an argument inside another function call, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack. Example code: python @internal def fooa: uint256, b: uint256, c: uint256 - uint256,...

PT-2026-115980

Impact When we pass a multi-dimensional array like 1, 2, 3, 4 as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code:...