CVE-2023-42460: Vyper - Incorrect Bounds Checking in _abi_decode() Function
Summary
CVE-2023-42460: Vyper is a Pythonic Smart Contract Language for the EVM. Affects vyper versions >= 0.3.4, < 0.3.10. Fixed in 0.3.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Pythonic Smart Contract Language for the EVM. It is designed to be secure and easy to audit. The language is specifically tailored for Ethereum smart contracts and aims to provide a higher level of safety compared to Solidity. Vyper contracts are compiled to EVM bytecode and can be deployed on the Ethereum blockchain. However, a vulnerability has been identified in Vyper versions 0.3.4 to 0.3.9 that affects the _abi_decode() function. This function is responsible for decoding ABI-encoded data in Vyper contracts. The vulnerability allows for bounds checking to be bypassed, leading to incorrect results and potential security issues.
Vulnerability Detail
The vulnerability in Vyper's _abi_decode() function arises from a lack of input validation when it is nested in an expression. This allows for the construction of inputs that can bypass bounds checking and produce incorrect results. An attacker could potentially exploit this vulnerability to manipulate contract data and compromise the integrity of smart contracts deployed using Vyper. The impact of this vulnerability can vary depending on the specific usage of _abi_decode(), but it has the potential to result in financial losses, unauthorized access, or other security breaches.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.10
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
At present, there is no known workaround for this vulnerability. It is recommended to follow the official Vyper channels for updates on the release of version 0.3.10, which will include the fix for this issue.
Conclusion
The vulnerability in Vyper's _abi_decode() function can allow for bounds checking to be bypassed, resulting in incorrect results and potential security breaches. Users of Vyper are advised to update to version 0.3.10, which is expected to include a fix for this vulnerability. Regularly checking for updates and promptly applying them is crucial to ensure the security and stability of Vyper contracts. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is a Pythonic Smart Contract Language for the EVM. It is designed to provide a higher level of safety and security compared to Solidity.
The _abi_decode() function is responsible for decoding ABI-encoded data in Vyper contracts.
Vyper versions 0.3.4 to 0.3.9 are affected by this vulnerability.
The vulnerability can lead to incorrect results and potential security breaches, including financial losses and unauthorized access.
A fix is expected to be included in the upcoming release, version 0.3.10. Users are advised to update to this version as soon as it becomes available.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
