CVE-2023-32059: Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls
Summary
CVE-2023-32059: Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls. Affects vyper versions < 0.3.8. Fixed in 0.3.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vyper is an open-source Python-based programming language specifically designed for writing smart contracts on the Ethereum blockchain. It offers a simplified syntax and enhanced security features compared to other languages. However, a vulnerability has been discovered in Vyper that affects the correct ordering of arguments for kwargs passed to internal calls.
Vulnerability Detail
The vulnerability arises when internal calls to internal functions with more than one default argument are compiled incorrectly. The defaults are added from left to right instead of right to left, depending on the number of arguments provided in the call. This incorrect compilation can lead to type incompatibility issues and bypass typechecking. For example, in the bar() function, the call self.foo(13) is compiled as self.foo(13,12) instead of self.foo(13,1337). It is important to note that the ability to pass kwargs to internal functions is an undocumented feature and not widely used.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.8
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Users are advised to upgrade to the patched version.
Conclusion
The vulnerability in Vyper that allows incorrect ordering of arguments for kwargs passed to internal calls has been identified and patched. Users are advised to upgrade to version 0.3.8 of Vyper to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is an open-source Python-based programming language designed for writing smart contracts on the Ethereum blockchain.
The vulnerability can result in incorrect compilation of internal function calls, leading to type incompatibility issues and bypassing typechecking.
Yes, the vulnerability has been patched in version 0.3.8 of Vyper. Users should upgrade to the latest version to fix the vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the patched version is the recommended solution.
No, the ability to pass kwargs to internal functions is an undocumented feature and not widely used.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
