Threat database

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.

Vyper versions 0.3.4 through 0.5.0b1 contain a vulnerability in the create_from_blueprint function where an unchecked uint256 subtraction can cause an integer wraparound. This allows an attacker controlling the code_offset parameter to deploy contracts with no runtime code, potentially trapping ETH and tokens.

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

Vyper versions from 0.1.0b1 up to but not including 0.1.0b17, and versions 0.4.1 through 0.5.0b1, have a vulnerability where the source-line table is built using str.splitlines(), which treats certain characters as line breaks differently than the Python parser. This discrepancy allows an attacker to hide special characters in comments, strings, or indentation to alter numeric literals silently.

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

Vyper versions 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 have a vulnerability in the handling of Unicode encoding in the parsing of source code. The issue arises from mixing character-based line offsets with Python's UTF-8 byte column offsets, causing multi-byte characters to shift source slices used for reconstructing numeric literals. This allows an attacker to use non-ASCII identifiers that normalize to ASCII or invisible byte-order marks to silently substitute addresses, integers, or other constants in compiled code.

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the `build_IR` for `concat` doesn't properly adhere to the API of copy functions (for `>=0.3.2` the `copy_bytes` function). A contract search was performed and no vulnerable contracts were found in production. The buffer overflow can result in the change of semantics of the contract. The overflow is length-dependent and thus it might go unnoticed during contract testing. However, certainly not all usages of concat will result in overwritten valid data as we require it to be in an internal function and close to the return statement where other memory allocations don't occur. This issue has been addressed in 0.4.0.

EPSS 0.8%Vulnerabilityvyperlang#cwe-120Germany+6