CVE-2024-32647: Vyper Package Suffers from Double Eval Vulnerability
Summary
CVE-2024-32647: Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Affects vyper versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a pythonic Smart Contract Language designed for the Ethereum virtual machine. It emphasizes security and simplicity, making it a popular choice for developers creating smart contracts. Vyper's syntax is designed to be easy to read and understand, which helps in reducing the likelihood of errors in contract development. However, certain versions of Vyper are susceptible to a vulnerability that can lead to unintended consequences during contract execution.
Vulnerability Detail
In versions 0.3.10 and prior of Vyper, the create_from_blueprint builtin can lead to a double evaluation vulnerability when the raw_args=True and the args argument has side effects. The issue arises because the _build_create_IR function does not cache the args argument to the stack, allowing it to be evaluated multiple times instead of retrieving the value from the stack. This can result in unexpected behavior in smart contracts, although no vulnerable production contracts have been identified. The impact is considered low, as double evaluation of side effects should be easily detectable in client tests.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
pip install --upgrade "vyper==0.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the create_from_blueprint builtin with raw_args=True in your smart contracts until you can upgrade to a patched version of Vyper.
Conclusion
The Vyper package has a vulnerability (CVE-2024-32647) that can lead to double evaluation of arguments in certain scenarios. While the impact is low and no production contracts are known to be affected, it is crucial to upgrade to version 0.4.0 or later to mitigate any potential risks. Users can also utilize Vulert to monitor and check for vulnerabilities in their applications.
See every vulnerability recorded for vyper →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
No known production contracts have been found to be affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot upgrade immediately, avoid using the create_from_blueprint builtin with raw_args=True as a temporary workaround.
Vyper is primarily used for writing smart contracts on the Ethereum blockchain, focusing on security and simplicity.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
