CVE-2022-24845: Vyper - Integer Misinterpretation Vulnerability
Summary
CVE-2022-24845: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Affects vyper across 2 version ranges.
< 0.3.2
< 049dbdc647b2ce838fae7c188e6bb09cf16e470b
Fixed in 049dbdc647b2ce838fae7c188e6bb09cf16e470b. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. It is used to write smart contracts that run on the Ethereum blockchain. Vyper aims to be more secure and easier to audit than Solidity, the most widely used language for Ethereum smart contracts. However, Vyper is vulnerable to an Integer Misinterpretation issue.
Vulnerability Detail
The vulnerability in Vyper arises from the lack of validation for the return value of <iface>.returns_int128(). This can result in a misinterpretation of the integer value and lead to incorrect behavior. While simple expressions are validated as of v0.3.0, complex expressions are not. This vulnerability can have various ramifications, including incorrect calculations, unexpected behavior, and potential security risks.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
049dbdc647b2ce838fae7c188e6bb09cf16e470b
This is the first release that contains the fix.
pip install --upgrade "vyper==049dbdc647b2ce838fae7c188e6bb09cf16e470b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
The Integer Misinterpretation vulnerability in Vyper can lead to incorrect behavior and potential security risks in smart contracts. Users are advised to upgrade to Vyper version 0.3.2 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. It is used to write smart contracts that run on the Ethereum blockchain.
The vulnerability can result in misinterpretation of integer values, leading to incorrect behavior in smart contracts written using Vyper. This can have various consequences, including incorrect calculations, unexpected behavior, and potential security risks.
To fix this vulnerability, you should upgrade to Vyper version 0.3.2 or later. The fix ensures proper validation of the return value of <iface>.returns_int128() for both simple and complex expressions.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the Vyper advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/vyper/PYSEC-2022-198.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
