38 matches found
CVE-2024-22419
CVE-2024-22419 affects the Vyper compiler/runtime: the built-in concat can write past the allocated memory buffer, potentially corrupting memory and changing contract semantics. The root cause is the build_IR path not properly conforming to the copy_bytes API for versions >= 0.3.2, enabling a ...
CVE-2024-24559
CVE-2024-24559 : Vyper SHA3 codegen bug due to miscalculated height in IR for sha3_64. Can only be triggered with hand-written IR; not exposed by regular vyper code. Public advisories describe a low-impact issue, with a hand-written IR PoC and a patch patch (PR 4063) fixing the problem. Exploitat...
CVE-2024-24564
Vyper CVE-2024-24564 describes a memory-safety issue with extract32(b, start): if the start argument can mutate b, extracting 32 bytes may read and return dirty memory. The defect affects older Vyper versions (e.g., 0.3.10 and earlier) and is fixed in 0.4.0. Red Hat and other sources list the sam...
CVE-2024-26149
CVE-2024-26149 (Vyper _abi_decode memory overflow) has a concrete description: in Vyper 0.3.10 and earlier, specifying an excessively large starting index for an array inside the function _abi_decode can cause the read position to overflow, allowing decoding of values outside the intended array b...
CVE-2022-24845
CVE-2022-24845 concerns a bounds error in Vyper: the return of .returns_int128() is not always validated against int128 bounds in complex expressions, potentially causing misinterpreted values and incorrect behavior. Documents consistently cite vulnerability in Vyper up to v0.3.0, with a patch av...
CVE-2022-29255
CVE-2022-29255 affects the Vyper smart contract language prior to 0.3.4, where calling an external contract with no return value could cause the contract address (including side effects) to be evaluated twice. This double evaluation could lead to incorrect outcomes in contracts. The issue has bee...
CVE-2022-24788
CVE-2022-24788 affects Vyper up to version 0.3.2, where importing a function from a JSON interface returning bytes can generate bytecode that does not clamp bytes length, potentially causing a buffer overrun. A fixed version is 0.3.2; users should upgrade to this release. Several sources (e.g., R...
CVE-2025-27105
CVE-2025-27105 concerns vyper, a Pythonic smart contract language for the EVM. The issue arises in AugAssign handling when the target is an access to a dynamic array (DynArray); if the right-hand side modifies the array, the target is cached and the bounds check may not be re-evaluated during the...
CVE-2023-37902
Vyper (Pythonic language for the EVM) has a vulnerability in the ecrecover precompile prior to version 0.3.10, where the output buffer may contain undefined data if a signature does not verify. The ecrecover builtin can still return memory contents at address 0, potentially causing a signature ch...
CVE-2021-41121
CVE-2021-41121 (Vyper) affects the Vyper compiler/language used for EVM smart contracts. The issue occurs in affected versions when performing a function call inside a literal struct, caused by an incorrect pointer to the top of the stack, leading to memory corruption. The vulnerability has been ...
CVE-2022-24787
CVE-2022-24787 (Vyper) affects the Vyper language (Pythonic smart contract language for the EVM) in version 0.3.1 and earlier. The issue is that bytestrings can contain dirty bytes, causing word-for-word comparisons to yield incorrect results. Even without dirty nonzero bytes, two bytestrings may...
CVE-2021-41122
CVE-2021-41122 affects the Vyper smart contract language. The issue is that in affected versions, external functions did not properly validate the bounds of decimal arguments, enabling logic errors. The root cause is insufficient bounds checking for decimal inputs in external function definitions...
CVE-2025-21607
The CVE-2025-21607 issue affects the Vyper Pythonic smart contract language compiler when using precompiles EcRecover (0x1) and Identity (0x4); the success flag of those calls isn’t checked, allowing an attacker to allocate gas to cause a precompile to fail while the rest of execution continues, ...
CVE-2025-26622
The CVE concerns vyper’s sqrt() builtin, which uses the Babylonian method for decimals. The problem arises from improper handling of oscillating final states, which can cause sqrt to return a rounded-up value (e.g., for certain inputs, 0.9999999998 → 0.9999999999). The issue is detailed in the GH...
CVE-2024-32649
Vyper CVE-2024-32649 affects versions 0.3.10 and earlier, where the sqrt builtin’s build_IR does not cache its argument, allowing potential double evaluation when the argument has side-effects. The affected component is the sqrt builtin in Vyper’s IR generation, leading to multiple evaluations of...
CVE-2025-27104
Vulnerability CVE-2025-27104 affects vyper (Pythonic Smart Contract Language for the EVM): a for-loop iterator target can cause multiple evaluations of the iterator expression, allowing side effects from the loop body to be consumed and interleaved with reads in the loop, leading to unexpected pr...
CVE-2023-40015
Vyper CVE-2023-40015 describes a compiler behavior issue where the argument evaluation order for a set of expressions is from right to left instead of left to right. The affected language constructs include unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, bitwise operators (|, &, ^, an...
CVE-2024-24567
The CVE-2024-24567 issue concerns Vyper, a Pythonic language for the Ethereum VM. The vulnerability is in the Vyper compiler’s raw_call builtin, where a value argument can be passed even when the call is delegatecall or staticcall. However, due to the semantics of delegatecall/staticcall opcodes,...
CVE-2024-32646
Vyper CVE-2024-32646 affects the Pythonic smart contract language. The vulnerability concerns the builtin slice when the buffer is msg.data, self.code, or .code and either the start or length has side-effects, causing a double evaluation of those side-effects. It is triggerable only in versions e...
CVE-2023-30837
CVE-2023-30837 (Vyper) affects the Vyper compiler/language prior to version 0.3.8, where the storage allocator does not guard against allocation overflows. This can allow an attacker to overwrite the owner variable in affected contracts. The issue is fixed in version 0.3.8. Multiple connected sou...
CVE-2024-32481
Vyper (Pythonic EVM language) is affected by CVE-2024-32481 in versions from 0.3.8 up to, but not including, 0.4.0b1. The vulnerability arises when looping with range(start, start + N) where start is negative; an incorrect assertion in the code generation of the range statement (stmt.parse_For_ra...
CVE-2023-41052
Vyper CVE-2023-41052 affects the Pythonic smart contract language Vyper. In affected versions, the evaluation order of arguments to builtins uint256_addmod, uint256_mulmod, ecadd, and ecmul does not follow source order, which can cause side effects in one argument to be relied upon by others. The...
CVE-2023-32058
CVE-2023-32058 affects the Vyper language (EVM smart contracts). Prior to version 0.3.8, there was a missing overflow check for loop variables when iterating with patterns like for i in range(a, a + N). This could cause the loop variable’s type to overflow. The issue appears specifically in for i...
CVE-2023-42441
CVE-2023-42441 affects the Vyper language. From versions 0.2.9 up to, but not including, 0.3.10, locks using @nonreentrant("") or @nonreentrant('') fail to perform reentrancy checks at runtime. The issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string. Affe...
CVE-2024-32647
Vyper vulnerability CVE-2024-32647 concerns the create_from_blueprint builtin prior to version 0.3.11. The root cause is that the _build_create_IR path does not cache the args parameter on the stack when raw_args=True and args have side-effects, allowing the argument to be evaluated multiple time...
CVE-2024-32648
CVE-2024-32648 affects the Vyper smart contract language. Before version 0.3.0, default functions did not respect nonreentrancy keys and the lock was not emitted, but no vulnerable production contracts were found. The issue has a low impact, and a patch is available in version 0.3.0. Remediation:...
CVE-2023-32675
CVE-2023-32675 affects Vyper prior to 0.3.8. In contracts with more than one regular nonpayable function, funds could be sent to the default function even if it is nonpayable due to an early calldatasize check, as described in public advisories. The issue was fixed by removing the global calldata...
CVE-2024-24561
CVE-2024-24561 (Vyper) : The vulnerability is in the built-in slice() bounds check for Vyper up to version 0.3.10, where the runtime check does not account for overflow of start + length when arguments are non-literal. This can enable out-of-bounds (OOB) access to storage, memory, or calldata and...
CVE-2023-32059
The CVE-2023-32059 entry describes a vulnerability in Vyper (Pythonic smart contract language for EVM) prior to version 0.3.8. Root cause: internal calls with default arguments are compiled with incorrect ordering, causing defaults to be applied left-to-right instead of right-to-left, and in some...
CVE-2023-39363
Vyper CVE-2023-39363 vulnerability: in Vyper versions 0.2.15, 0.2.16, and 0.3.0, named re-entrancy locks are allocated per function, not per key, enabling cross-function re-entrancy when a contract uses @nonreentrant with a specific key and path-dependent state updates before storage (breaking ch...
CVE-2024-32645
Vyper (Pythonic smart contract language for the EVM) is affected by CVE-2024-32645 in versions 0.3.10 and earlier. The root cause is in the RawLog.build_IR path: it fails to unwrap variables provided as topics, causing incorrect values to be logged as topics. As of publication, no fixed version i...
CVE-2023-30629
CVE-2023-30629 affects the Vyper compiler (versions 0.3.1–0.3.7). When using built-in function raw_call with revert_on_failure=False and max_outsize=0 , the compiler generates incorrect bytecode, causing the returned value from the call to be an unreliable boolean (may be True or False) depending...
CVE-2024-24563
CVE-2024-24563 affects Vyper, where arrays can be indexed by signed integers even though defined for unsigned indices. The typechecker permits signed integers as array indexes, and with very large arrays, bounds checks can pass for negative values, leading to potential unpredictable behavior, acc...
CVE-2023-31146
Vyper prior to 0.3.8 is vulnerable to out-of-bounds access in codegen when a dynarray is on both the LHS and RHS of an assignment. The length word is written before the data, enabling OOB access and potential data corruption across call frames. The issue is fixed in version 0.3.8. Affected produc...
CVE-2023-42460
CVE-2023-42460 affects Vyper (EVM Python-like language). The _abi_decode() function does not validate input when nested in an expression, enabling construction that bypasses bounds checking and may yield incorrect results. No exploitation details are provided in the documents, and the vulnerabili...
CVE-2024-24560
CVE-2024-24560 concerns Vyper’s handling of external calls, where the return buffer can overflow into the input buffer due to memory layout and the RETURNDATASIZE length check for dynamic types. The result can cause a contract to read malformed data from the input buffer instead of the intended r...
CVE-2023-46247
CVE-2023-46247 concerns Vyper (EVM) where contracts with large arrays could underallocate storage slots by 1 due to a rounding error in the calculation of required slots. Prior to v0.3.8, storage size was computed as ceil(type_.size_in_bytes / 32); when type_.size_in_bytes is large (>2**46) or...