CVE-2023-31146: Vyper vulnerable to OOB DynArray access
Summary
CVE-2023-31146: Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment. Affects vyper versions < 0.3.8. Fixed in 0.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is an open-source programming language that is designed for developing smart contracts on the Ethereum blockchain. It is primarily used for writing secure and efficient code for decentralized applications (dApps). Vyper provides a high-level syntax and enforces strict security measures to prevent common vulnerabilities in smart contracts.
Vulnerability Detail
The vulnerability in Vyper allows for out-of-bounds (OOB) dynamic array access when the array is on both the left-hand side (LHS) and right-hand side (RHS) of an assignment. This issue occurs during code generation, where the length word of a dynamic array is written before the data. As a result, it can lead to OOB array access, potentially causing data corruption or unexpected behavior. The vulnerability has a CVSS score of 7.5 (High).
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.8
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to upgrade to the latest patched version of Vyper.
Conclusion
The vulnerability in Vyper allows for out-of-bounds dynamic array access, which can lead to data corruption or unexpected behavior in smart contracts. It is recommended to upgrade to the latest patched version of Vyper (0.3.8 or later) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source programming language for writing secure and efficient smart contracts on the Ethereum blockchain.
The vulnerability can lead to out-of-bounds array access, potentially causing data corruption or unexpected behavior in smart contracts written using Vyper.
To fix the vulnerability, you should upgrade to the latest patched version (0.3.8 or later) of the Vyper package.
There are no known workarounds for this vulnerability. Upgrading to the patched version is the recommended solution.
You can find more information about this vulnerability in the Vyper GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-3p37-3636-q8wv/GHSA-3p37-3636-q8wv.json
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
