vyper 0.4.1b4: known vulnerabilities

Could not compare 16 records. The results are incomplete.

1. CVE-2025-47774

   Low · CVSS 2.9EPSS 0.48%No fix published

   Vyper's `slice()` may elide side-effects when output length is 0

   Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `<address>.code`). The reason is that for these source locations, the check that `length >= 1` is skipped. The result is that a 0-length bytestring constructed with slice can be passed to `make_byte_array_copier`, which elides evaluation of its source argument when the max length is 0. The impact is that side effects in the `start` argument may be elided when the `length` argument is 0, e.g. `slice(m

   vyperPython

   Published May 15, 2025Updated May 15, 2025

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

2. CVE-2025-47285

   Low · CVSS 2.9EPSS 0.46%No fix published

   Vyper's `concat()` builtin may elide side-effects for zero-length arguments

   Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero. In practice, it would be very unusual in user code to construct zero-length bytestrings using an expression with side-effects, since zero-length bytestrings are typically constructed with the empty literal `b""`; the only way to construct an empty bytestring which has side effects would be with the ternary operator intro

   vyperPython

   Published May 15, 2025Updated May 15, 2025

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

3. CVE-2025-26622

   Low · CVSS 2.3EPSS 0.33%Fix available

   sqrt doesn't define rounding behavior in Vyper

   vyper is a Pythonic Smart Contract Language for the EVM. Vyper `sqrt()` builtin uses the babylonian method to calculate square roots of decimals. Unfortunately, improper handling of the oscillating final states may lead to sqrt incorrectly returning rounded up results. This issue is being addressed and a fix is expected in version 0.4.1. Users are advised to upgrade as soon as the patched release is available. There are no known workarounds for this vulnerability.

   vyperPython

   • Update to 0.4.1

   Published February 21, 2025Updated February 22, 2025

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

4. CVE-2025-27104

   Low · CVSS 2.3EPSS 0.45%Fix available

   double eval in For List Iter in Vyper

   vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body (e.g. read a storage variable updated in the loop body) and thus lead to unexpected program behavior. Specifically, reads in iterators which contain an ifexp (e.g. `for s: uint256 in ([read(), read()] if True else [])`) may interleave reads with writes in the loop body. Vyper for loops allow two kinds of iterator targets, namely the `range()` builtin and an iterable type, like SArr

   vyperPython

   • Update to 0.4.1

   Published February 21, 2025Updated February 22, 2025

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

5. CVE-2025-27105

   Low · CVSS 2.3EPSS 0.57%Fix available

   AugAssign evaluation order causing OOB write within the object in Vyper

   vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. This issue has been addressed in version 0.4.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

   vyperPython

   • Update to 0.4.1

   Published February 21, 2025Updated February 22, 2025

   Source advisory 1 ↗Source advisory 2 ↗

6. CVE-2025-21607

   Low · CVSS 2.3EPSS 0.67%Fix available

   Success of Certain Precompile Calls not Checked in Vyper

   Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. No

   vyper vyperPython

   • Update to 0.4.1

   Published January 14, 2025Updated April 24, 2025

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

7. CVE-2023-40015

   Low · CVSS 3.7EPSS 0.49%No fix published

   Vyper: reversed order of side effects for some operations

   Vyper is a Pythonic Smart Contract Language. For the following (probably non-exhaustive) list of expressions, the compiler evaluates the arguments from right to left instead of left to right. `unsafe_add, unsafe_sub, unsafe_mul, unsafe_div, pow_mod256, |, &, ^ (bitwise operators), bitwise_or (deprecated), bitwise_and (deprecated), bitwise_xor (deprecated), raw_call, <, >, <=, >=, ==, !=, in, not in (when lhs and rhs are enums)`. This behaviour becomes a problem when the evaluation of one of the arguments produces side effects that other arguments depend on. The following expressions can produce side-effect: state modifying external call , sta

   vyperPython

   Published September 4, 2023Updated November 19, 2024

   Source advisory 1 ↗Source advisory 2 ↗

8. CVE-2023-39363

   Critical · CVSS 9.1EPSS 0.82%No fix published

   Vyper incorrectly allocated named re-entrancy locks

   Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the

   vyperPython

   Published August 7, 2023Updated October 11, 2024

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗