CVE-2022-29255: Multiple evaluation of contract address in call in vyper
Summary
CVE-2022-29255: Multiple evaluation of contract address in call in vyper. Affects vyper versions < 0.3.4. Fixed in 0.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vyper package is an open-source programming language that is used to write smart contracts for the Ethereum blockchain. It provides a high-level language for expressing smart contract logic and is designed to be secure and efficient. However, a vulnerability has been discovered in vyper that allows for multiple evaluation of the contract address in a call, potentially leading to double evaluation of side effects.
Vulnerability Detail
The vulnerability occurs when calling an external contract with no return value. In certain cases, the contract address could be evaluated twice, which is usually an efficiency problem. However, if the evaluation of the contract address has side effects, it could result in double evaluation of those side effects. This could potentially lead to unexpected behavior or security issues in smart contracts. The vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.4
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to assign the contract address to a variable before making the call. This ensures that the contract address is only evaluated once. Here is an example of how the code can be modified to incorporate the workaround:
@external
def do_stuff():
t: Foo = Foo(msg.sender).bar()
t.foo()
Conclusion
The vulnerability in vyper that allows for multiple evaluation of the contract address in a call has been identified and patched. Users are advised to update their vyper package to version 0.3.4 or later to fix the vulnerability. A workaround is also available by assigning the contract address to a variable before making the call. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source programming language used to write smart contracts for the Ethereum blockchain.
The vulnerability allows for double evaluation of the contract address in a call, potentially leading to unexpected behavior or security issues in smart contracts.
To fix the vulnerability, update the vyper package to version 0.3.4 or later.
Yes, a workaround is to assign the contract address to a variable before making the call.
The CVSS score of this vulnerability is 7.5, indicating a high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
