CVE-2023-30837: vyper vulnerable to storage allocator overflow
Summary
CVE-2023-30837: vyper vulnerable to storage allocator overflow. Affects vyper versions < 0.3.8. Fixed in 0.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vyper package is an open-source programming language for Ethereum smart contracts. It is designed to be secure and efficient, providing developers with a high-level language for writing smart contracts on the Ethereum blockchain. However, the package is vulnerable to a storage allocator overflow issue.
Vulnerability Detail
The storage allocator in vyper does not guard against allocation overflows. This vulnerability allows an attacker to overwrite the owner variable by calling the contract with specific calldata. By exploiting this vulnerability, an attacker can modify the owner variable and potentially gain unauthorized access or control over the smart contract. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.8
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users must upgrade to the patched version to mitigate the risk.
Conclusion
The vyper package is vulnerable to a storage allocator overflow issue, which can allow an attacker to overwrite important variables in a smart contract. To mitigate this vulnerability, users should upgrade to version 0.3.8 or later of the vyper package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source programming language for Ethereum smart contracts. It provides a high-level language for writing secure and efficient smart contracts on the Ethereum blockchain.
A storage allocator overflow is a vulnerability that occurs when the storage allocator does not properly guard against allocation overflows. This can allow an attacker to overwrite important variables or data in a smart contract.
The impact of this vulnerability is that an attacker can overwrite the owner variable of a vyper smart contract, potentially gaining unauthorized access or control over the contract.
To fix this vulnerability, you should upgrade to version 0.3.8 or later of the vyper package. This will include the necessary patch to mitigate the storage allocator overflow issue.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the only solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
