CVE-2023-32058: Vyper - Overflow Vulnerability
Summary
CVE-2023-32058: Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Affects vyper across 2 version ranges.
< 0.3.8
< 3de1415ee77a9244eb04bdb695e249d3ec9ed868
Fixed in 3de1415ee77a9244eb04bdb695e249d3ec9ed868. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Pythonic smart contract language designed for the Ethereum virtual machine. It provides a more secure and user-friendly alternative to Solidity. Vyper allows developers to write smart contracts with reduced attack surface and improved readability. However, prior to version 0.3.8, Vyper is vulnerable to an overflow issue in loop variables. This vulnerability occurs when assigning the iterator of a loop to a variable, potentially leading to a type overflow. The issue is specific to loops of the form 'for i in range(a, a + N)'. The Vyper compiler fails to detect this overflow, resulting in a potential security risk.
Vulnerability Detail
The vulnerability in Vyper arises from the absence of an overflow check for loop variables. When assigning the iterator of a loop to a variable in loops of the form 'for i in range(a, a + N)', it is possible to overflow the type of the variable. This overflow can lead to unexpected behavior and potential security vulnerabilities. It is important to note that this issue does not occur in loops of the form 'for i in range(start, stop)' or 'for i in range(stop)', as the Vyper compiler can raise a TypeMismatch error in those cases. The vulnerability has been addressed in version 0.3.8 of Vyper.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3de1415ee77a9244eb04bdb695e249d3ec9ed868
This is the first release that contains the fix.
pip install --upgrade "vyper==3de1415ee77a9244eb04bdb695e249d3ec9ed868"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to Vyper version 0.3.8 or later.
Conclusion
The vulnerability in Vyper, prior to version 0.3.8, allows for potential type overflow in loop variables. This can lead to unexpected behavior and potential security risks in smart contracts. To mitigate this vulnerability, it is crucial to update to Vyper version 0.3.8 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is a Pythonic smart contract language for the Ethereum virtual machine. It aims to provide a more secure and user-friendly alternative to Solidity.
The vulnerability allows for potential type overflow in loop variables, which can lead to unexpected behavior and potential security risks in smart contracts written using Vyper.
To fix this vulnerability, update your Vyper version to 0.3.8 or later.
No, only versions prior to 0.3.8 are affected by this vulnerability.
There is no specific workaround mentioned for this vulnerability. Updating to Vyper version 0.3.8 or later is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
