Vyper: Return inside for loop more than 1 level deep

The vulnerability arises when a return statement is executed inside a for loop nested more than one level deep within internal function calls in Vyper smart contracts. This triggers an invalid jump destination error, causing the transaction to revert unnecessarily due to a stack underflow. The problem was responsibly disclosed and affects Vyper versions from 0.1.0b10 up to but excluding 0.2.3. The fix was implemented in Vyper 0.2.3. A workaround is to avoid returning inside such nested for loops.

The impact is limited to causing transaction reverts due to invalid jump destinations when return statements are used inside nested for loops in internal calls. This can lead to denial-of-service conditions in public contracts under specific scenarios. However, the issue is unlikely to be encountered without nested calls and return statements inside loops, and reverts should be noticeable during testing.

Upgrade to Vyper version 0.2.3 or later, where this issue is fixed. Alternatively, avoid using return statements inside for loops nested more than one level deep in internal calls as a workaround.