Threat Intelligence Database

Vyper versions 0.3.4 through 0.5.0b1 contain a vulnerability in the create_from_blueprint function where an unchecked uint256 subtraction can cause an integer wraparound. This allows an attacker controlling the code_offset parameter to deploy contracts with no runtime code, potentially trapping ETH and tokens.

Vyper versions 0.3.8 through 0.5.0b1 contain an optimizer miscompilation vulnerability where certain ternary expressions involving bitwise OR with a nonzero integer literal are incorrectly compiled to the constant 1. This causes affected smart contracts to use incorrect values in storage writes, arithmetic operations, indexing, return values, or events, potentially leading to incorrect deposit records and locked funds.

Vyper versions from 0.1.0b1 up to but not including 0.1.0b17, and versions 0.4.1 through 0.5.0b1, have a vulnerability where the source-line table is built using str.splitlines(), which treats certain characters as line breaks differently than the Python parser. This discrepancy allows an attacker to hide special characters in comments, strings, or indentation to alter numeric literals silently.

Vyper versions 0.3.8 through 0.5.0b1 have a compiler miscompilation vulnerability in the parse_IfExp function. This flaw causes incorrect memory layout handling when reading nested arrays with narrower inner bounds, leading to corrupted stored values or contract reverts when a ternary expression selects the narrower array.