Storage Corruption Vulnerability in Vyper
Summary
GHSA-7f92-rr6w-cq64: Storage corruption due to variables overwritten by re-entrancy locks. Affects vyper versions >= 0.2.13, < 0.2.15. Fixed in 0.2.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is an open-source programming language that is used to write smart contracts for the Ethereum blockchain. It is designed to be secure, simple, and auditable. The language is specifically tailored for Ethereum and aims to provide a higher level of security compared to other languages like Solidity. However, a vulnerability has been discovered in versions 0.2.13 to 0.2.14 of Vyper.
Vulnerability Detail
The vulnerability in Vyper arises when using the @nonreentrant decorator. Reentrancy protection storage slots are allocated to the same slots as storage variables, resulting in the corruption of storage variables. This can lead to unexpected behavior and potential security issues in smart contracts deployed using Vyper. The issue was fixed in version 0.2.15 of Vyper.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.15
This is the first release that contains the fix.
pip install --upgrade "vyper==0.2.15"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 0.2.15 is not immediately feasible, developers can avoid using the @nonreentrant decorator in versions 0.2.13 to 0.2.14 of Vyper. By not using this decorator, the storage corruption issue can be mitigated.
Conclusion
The storage corruption vulnerability in Vyper can have serious implications for smart contracts deployed on the Ethereum blockchain. It is crucial for developers to upgrade to version 0.2.15 of Vyper or avoid using the @nonreentrant decorator in affected versions. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source programming language for writing smart contracts on the Ethereum blockchain. It aims to provide a higher level of security and simplicity compared to other languages like Solidity.
The vulnerability can lead to storage corruption in smart contracts written using Vyper. This can result in unexpected behavior and potential security issues.
To fix this vulnerability, upgrade to version 0.2.15 of Vyper and recompile your smart contracts. Alternatively, avoid using the @nonreentrant decorator in versions 0.2.13 to 0.2.14.
No, only versions 0.2.13 to 0.2.14 of Vyper are affected. The issue was fixed in version 0.2.15.
Yes, if upgrading to version 0.2.15 is not immediately feasible, you can avoid using the @nonreentrant decorator in affected versions of Vyper.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
