CVE-2021-41122: Vyper - Missing Clamps for Decimal Args in External Functions
Summary
CVE-2021-41122: missing clamps for decimal args in external functions. Affects vyper versions < 0.3.0. Fixed in 0.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is an open-source Python-based programming language specifically designed for writing smart contracts on the Ethereum blockchain. It aims to provide a higher level of security and simplicity compared to other languages like Solidity. Vyper allows developers to write smart contracts that are less prone to vulnerabilities and exploits. However, a vulnerability has been discovered in Vyper related to missing clamps for decimal arguments in external functions.
Vulnerability Detail
The vulnerability in Vyper arises from a lack of proper validation for decimal arguments in external functions. The affected code snippet demonstrates this issue:
@external
def foo(x: decimal) -> decimal:
return x
This code does not perform bounds checking on the input decimal argument, potentially allowing for out-of-bounds values. An attacker could exploit this vulnerability by providing malicious input that exceeds the expected bounds, leading to unexpected behavior or manipulation of the contract's state. The impact of this vulnerability can vary depending on the specific use case and the contract's logic.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.0
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of Vyper is not feasible, a workaround for this vulnerability is to avoid using decimal arguments in external functions. By using alternative data types or handling decimal inputs differently, developers can mitigate the risk associated with this vulnerability.
Conclusion
The vulnerability in Vyper related to missing clamps for decimal arguments in external functions can potentially lead to unexpected behavior or manipulation of the contract's state. It is crucial for developers using Vyper to update their package to version 0.3.0 or later to address this vulnerability. If updating is not possible, developers should consider using alternative data types or handling decimal inputs differently to mitigate the risk. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source Python-based programming language designed for writing smart contracts on the Ethereum blockchain. It prioritizes security and simplicity.
The impact of this vulnerability can vary depending on the specific use case and the contract's logic. It could potentially lead to unexpected behavior or manipulation of the contract's state.
To fix this vulnerability, update your Vyper package to version 0.3.0 or later, specifically commit #2447. Run 'pip install --upgrade vyper' to update the package.
If updating to the latest version is not feasible, you can avoid using decimal arguments in external functions as a workaround for this vulnerability.
You can find more information about this vulnerability in the Vyper advisory on GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-c7pr-343r-5c46/GHSA-c7pr-343r-5c46.json
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
