CVE-2023-46247: Incorrect Storage Layout in Vyper Package
Summary
CVE-2023-46247: incorrect storage layout for contracts containing large arrays. Affects vyper versions < 0.3.8. Fixed in 0.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Vyper package is an open-source programming language for Ethereum smart contracts. It is designed to be more secure and auditable than Solidity, the most commonly used language for Ethereum contracts. Vyper aims to reduce the attack surface and potential vulnerabilities in smart contracts by providing a restricted set of features and a strong type system. However, a vulnerability has been discovered in versions prior to v0.3.8 that can lead to incorrect storage layout for contracts containing large arrays.
Vulnerability Detail
The vulnerability arises from an incorrect calculation to determine the number of slots needed for storage variables in contracts with large arrays. The calculation uses a floating-point step that can introduce rounding errors when the size of the array is close to a power of 2. This can result in underallocation or overwriting of storage variables. Two example contracts are provided to demonstrate the issue: one with a large fixed-size array and another with a large dynamic array. The risk of variable overwriting in the latter case is relatively small due to the high cost of extending the dynamic array to its full size. The vulnerability was patched in v0.3.8.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.8
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the patched version is the recommended solution.
Conclusion
The vulnerability in the Vyper package prior to v0.3.8 can result in incorrect storage layout for contracts with large arrays, potentially leading to overwriting of storage variables. Users are advised to upgrade to v0.3.8 or later to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source programming language for Ethereum smart contracts that aims to improve security and audibility.
The vulnerability can result in incorrect storage layout for contracts containing large arrays, potentially leading to overwriting of storage variables.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can analyze your Pipfile.lock to identify any vulnerabilities.
There is no specific workaround provided for this vulnerability. Upgrading to the patched version (v0.3.8 or later) is the recommended solution.
You can find more information about the vulnerability in the GitHub advisory database at https://github.com/github/advisory-database/advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
