CVE-2023-32059: Vyper - Incorrect Compilation of Internal Calls with Default Arguments
Summary
CVE-2023-32059: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Affects vyper across 2 version ranges.
< 0.3.8
< c3e68c302aa6e1429946473769dd1232145822ac
Fixed in c3e68c302aa6e1429946473769dd1232145822ac. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Pythonic smart contract language designed for the Ethereum virtual machine. It provides a more user-friendly and secure alternative to Solidity, the most commonly used language for Ethereum smart contracts. Vyper aims to reduce the attack surface and make it easier to write secure and auditable smart contracts. However, prior to version 0.3.8, Vyper had a vulnerability related to the compilation of internal calls with default arguments.
Vulnerability Detail
The vulnerability in Vyper arises from the incorrect compilation of internal calls with default arguments. When default arguments are provided in an internal call, they are added in the wrong order, resulting in potential type incompatibility issues. This incorrect compilation can bypass typechecking, allowing for the execution of code with incompatible types. The ability to pass keyword arguments (kwargs) to internal functions, although undocumented, further exacerbates the vulnerability. The issue has been patched in version 0.3.8 of Vyper.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
c3e68c302aa6e1429946473769dd1232145822ac
This is the first release that contains the fix.
pip install --upgrade "vyper==c3e68c302aa6e1429946473769dd1232145822ac"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The vulnerability in Vyper related to the incorrect compilation of internal calls with default arguments has been addressed in version 0.3.8. It is recommended to update Vyper to the latest version to mitigate the risk of potential type incompatibility issues and bypassed typechecking. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. It aims to provide a more secure and auditable alternative to Solidity.
The vulnerability allows for the execution of code with incompatible types, bypassing typechecking. This can potentially lead to unexpected behavior or security vulnerabilities in smart contracts written using Vyper.
To fix the vulnerability, update Vyper to version 0.3.8 or later.
No workaround has been provided for this vulnerability.
For more information, refer to the Vyper GitHub repository and the advisory database of the Python Package Index (PyPI).
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
