CVE-2025-21607: Vyper Compiler Vulnerability in Precompile Calls
Summary
CVE-2025-21607: Vyper Does Not Check the Success of Certain Precompile Calls. Affects vyper versions 0.1.0b1 – 0.4.1rc3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Python-based programming language designed for writing smart contracts on the Ethereum blockchain. It emphasizes security and simplicity, making it easier for developers to create robust contracts. However, certain versions of Vyper (0.2.0 to 0.4.0) contain a vulnerability that affects the handling of precompile calls, specifically EcRecover and Identity, leading to potential execution issues.
Vulnerability Detail
The vulnerability arises from the Vyper Compiler's failure to check the success of certain precompile calls, namely EcRecover (0x1) and Identity (0x4). When these calls fail, the remaining execution can continue with incorrect results. This is due to the EVM's gas forwarding rules, which leave a minimal amount of gas for subsequent operations. Although the likelihood of significant impact is low, it can lead to unexpected behaviors in contracts that rely on these precompiles.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers should implement additional checks after calling the ecrecover or identity functions to ensure that the results are valid. For example, check if the returned address is zero, indicating a failure:
@external @view
def foo(hash: bytes32, v: uint256, r: uint256, s: uint256) -> address:
result: address = ecrecover(hash, v, r, s)
assert result != ZERO_ADDRESS, 'ecrecover failed'
return result
Conclusion
The Vyper compiler vulnerability (CVE-2025-21607) highlights the importance of checking the success of precompile calls in smart contracts. While the risk of significant impact is low, developers should update to the patched version or implement workarounds to ensure contract integrity.
See every vulnerability recorded for vyper →
FAQ
Versions 0.2.0 to 0.4.0 of Vyper are affected by this vulnerability.
The vulnerability can lead to incorrect execution results in smart contracts, potentially causing unexpected behaviors.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, the vulnerability has been patched in Vyper version 0.4.1 and later.
If upgrading is not possible, implement additional checks after precompile calls to validate their results.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
