23 matches found
CVE-2024-24564
Vyper CVE-2024-24564 describes a memory-safety issue with extract32(b, start): if the start argument can mutate b, extracting 32 bytes may read and return dirty memory. The defect affects older Vyper versions (e.g., 0.3.10 and earlier) and is fixed in 0.4.0. Red Hat and other sources list the sam...
CVE-2022-29255
CVE-2022-29255 affects the Vyper smart contract language prior to 0.3.4, where calling an external contract with no return value could cause the contract address (including side effects) to be evaluated twice. This double evaluation could lead to incorrect outcomes in contracts. The issue has bee...
CVE-2022-24845
CVE-2022-24845 concerns a bounds error in Vyper: the return of .returns_int128() is not always validated against int128 bounds in complex expressions, potentially causing misinterpreted values and incorrect behavior. Documents consistently cite vulnerability in Vyper up to v0.3.0, with a patch av...
CVE-2022-24788
CVE-2022-24788 affects Vyper up to version 0.3.2, where importing a function from a JSON interface returning bytes can generate bytecode that does not clamp bytes length, potentially causing a buffer overrun. A fixed version is 0.3.2; users should upgrade to this release. Several sources (e.g., R...
CVE-2023-37902
Vyper (Pythonic language for the EVM) has a vulnerability in the ecrecover precompile prior to version 0.3.10, where the output buffer may contain undefined data if a signature does not verify. The ecrecover builtin can still return memory contents at address 0, potentially causing a signature ch...
CVE-2025-27105
CVE-2025-27105 concerns vyper, a Pythonic smart contract language for the EVM. The issue arises in AugAssign handling when the target is an access to a dynamic array (DynArray); if the right-hand side modifies the array, the target is cached and the bounds check may not be re-evaluated during the...
CVE-2021-41121
CVE-2021-41121 (Vyper) affects the Vyper compiler/language used for EVM smart contracts. The issue occurs in affected versions when performing a function call inside a literal struct, caused by an incorrect pointer to the top of the stack, leading to memory corruption. The vulnerability has been ...
CVE-2021-41122
CVE-2021-41122 affects the Vyper smart contract language. The issue is that in affected versions, external functions did not properly validate the bounds of decimal arguments, enabling logic errors. The root cause is insufficient bounds checking for decimal inputs in external function definitions...
CVE-2025-21607
The CVE-2025-21607 issue affects the Vyper Pythonic smart contract language compiler when using precompiles EcRecover (0x1) and Identity (0x4); the success flag of those calls isn’t checked, allowing an attacker to allocate gas to cause a precompile to fail while the rest of execution continues, ...
CVE-2024-32649
Vyper CVE-2024-32649 affects versions 0.3.10 and earlier, where the sqrt builtin’s build_IR does not cache its argument, allowing potential double evaluation when the argument has side-effects. The affected component is the sqrt builtin in Vyper’s IR generation, leading to multiple evaluations of...
CVE-2025-26622
The CVE concerns vyper’s sqrt() builtin, which uses the Babylonian method for decimals. The problem arises from improper handling of oscillating final states, which can cause sqrt to return a rounded-up value (e.g., for certain inputs, 0.9999999998 → 0.9999999999). The issue is detailed in the GH...
CVE-2024-32646
Vyper CVE-2024-32646 affects the Pythonic smart contract language. The vulnerability concerns the builtin slice when the buffer is msg.data, self.code, or .code and either the start or length has side-effects, causing a double evaluation of those side-effects. It is triggerable only in versions e...
CVE-2025-27104
Vulnerability CVE-2025-27104 affects vyper (Pythonic Smart Contract Language for the EVM): a for-loop iterator target can cause multiple evaluations of the iterator expression, allowing side effects from the loop body to be consumed and interleaved with reads in the loop, leading to unexpected pr...
CVE-2023-32058
CVE-2023-32058 affects the Vyper language (EVM smart contracts). Prior to version 0.3.8, there was a missing overflow check for loop variables when iterating with patterns like for i in range(a, a + N). This could cause the loop variable’s type to overflow. The issue appears specifically in for i...
CVE-2024-32647
Vyper vulnerability CVE-2024-32647 concerns the create_from_blueprint builtin prior to version 0.3.11. The root cause is that the _build_create_IR path does not cache the args parameter on the stack when raw_args=True and args have side-effects, allowing the argument to be evaluated multiple time...
CVE-2023-30837
CVE-2023-30837 (Vyper) affects the Vyper compiler/language prior to version 0.3.8, where the storage allocator does not guard against allocation overflows. This can allow an attacker to overwrite the owner variable in affected contracts. The issue is fixed in version 0.3.8. Multiple connected sou...
CVE-2024-32648
CVE-2024-32648 affects the Vyper smart contract language. Before version 0.3.0, default functions did not respect nonreentrancy keys and the lock was not emitted, but no vulnerable production contracts were found. The issue has a low impact, and a patch is available in version 0.3.0. Remediation:...
CVE-2023-32675
CVE-2023-32675 affects Vyper prior to 0.3.8. In contracts with more than one regular nonpayable function, funds could be sent to the default function even if it is nonpayable due to an early calldatasize check, as described in public advisories. The issue was fixed by removing the global calldata...
CVE-2024-32645
Vyper (Pythonic smart contract language for the EVM) is affected by CVE-2024-32645 in versions 0.3.10 and earlier. The root cause is in the RawLog.build_IR path: it fails to unwrap variables provided as topics, causing incorrect values to be logged as topics. As of publication, no fixed version i...
CVE-2023-32059
The CVE-2023-32059 entry describes a vulnerability in Vyper (Pythonic smart contract language for EVM) prior to version 0.3.8. Root cause: internal calls with default arguments are compiled with incorrect ordering, causing defaults to be applied left-to-right instead of right-to-left, and in some...
CVE-2023-31146
Vyper prior to 0.3.8 is vulnerable to out-of-bounds access in codegen when a dynarray is on both the LHS and RHS of an assignment. The length word is written before the data, enabling OOB access and potential data corruption across call frames. The issue is fixed in version 0.3.8. Affected produc...
CVE-2023-46247
CVE-2023-46247 concerns Vyper (EVM) where contracts with large arrays could underallocate storage slots by 1 due to a rounding error in the calculation of required slots. Prior to v0.3.8, storage size was computed as ceil(type_.size_in_bytes / 32); when type_.size_in_bytes is large (>2**46) or...