CVE-2022-24787: Vyper - Incorrect Comparison of Bytestrings
Summary
CVE-2022-24787: Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. Affects vyper across 2 version ranges.
< 0.3.2
< 2c73f8352635c0a433423a5b94740de1a118e508
Fixed in 2c73f8352635c0a433423a5b94740de1a118e508. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Pythonic Smart Contract Language designed for the Ethereum Virtual Machine. It allows developers to write smart contracts in a more Python-like syntax, making it easier to read and understand. Vyper is commonly used in Ethereum-based applications to create secure and efficient smart contracts.
Vulnerability Detail
In versions 0.3.1 and earlier of Vyper, there is a vulnerability that allows bytestrings to have dirty bytes, leading to incorrect word-for-word comparisons. Additionally, bytestrings can compare as equal if one ends with "\x00" due to a lack of length comparison. These issues can result in unexpected behavior and potential security vulnerabilities in smart contracts written using Vyper.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2c73f8352635c0a433423a5b94740de1a118e508
This is the first release that contains the fix.
pip install --upgrade "vyper==2c73f8352635c0a433423a5b94740de1a118e508"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Vyper versions 0.3.1 and earlier can lead to incorrect comparisons of bytestrings, potentially resulting in security vulnerabilities in smart contracts. It is crucial to update to Vyper version 0.3.2 or later to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. It provides a more Python-like syntax for writing smart contracts, making them easier to read and understand.
Versions 0.3.1 and earlier of Vyper are affected by this vulnerability.
The incorrect comparison of bytestrings in Vyper can lead to unexpected behavior and potential security vulnerabilities in smart contracts. This could result in financial losses or other malicious activities.
Currently, there are no known workarounds for this vulnerability. It is recommended to update to Vyper version 0.3.2 or later.
You can update your Vyper installation by running the following command: pip install --upgrade vyper.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
