CVE-2023-40015: Vyper - Evaluation Order Vulnerability
Summary
CVE-2023-40015: Vyper is a Pythonic Smart Contract Language. Affects vyper versions < 0.3.10rc1. Fixed in 0.3.10rc1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vyper is a Pythonic Smart Contract Language used for developing smart contracts on the Ethereum blockchain. It provides a simplified and secure programming environment for creating decentralized applications. However, a vulnerability has been discovered in Vyper that affects the evaluation order of certain expressions, leading to potential side effects and unexpected behavior.
Vulnerability Detail
The vulnerability in Vyper arises from the compiler's evaluation of arguments from right to left instead of the expected left to right order. This behavior impacts expressions such as unsafe arithmetic operations, bitwise operators, comparison operators, and certain function calls. When one of the arguments produces side effects that other arguments depend on, it can result in unintended consequences. Side effects can include state-modifying external or internal calls, raw calls, pop() operations on dynamic arrays stored in storage, and certain contract creation functions. This vulnerability can potentially lead to contract vulnerabilities, unexpected behavior, and security risks.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.10rc1
This is the first release that contains the fix.
pip install --upgrade "vyper==0.3.10rc1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can follow the recommended fix by updating their Vyper package to the latest version.
Conclusion
The evaluation order vulnerability in Vyper can have significant implications for smart contract development on the Ethereum blockchain. It is crucial to update to the latest version of Vyper (0.3.10rc1 or later) to ensure the correct evaluation order of expressions and mitigate potential side effects. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for vyper →
FAQ
Vyper is a Pythonic Smart Contract Language used for developing smart contracts on the Ethereum blockchain. It provides a simplified and secure programming environment for creating decentralized applications.
The vulnerability in Vyper can lead to unexpected behavior, potential contract vulnerabilities, and security risks. It is important to update to the latest version to mitigate these risks.
To fix this vulnerability, update your Vyper package to the latest version (0.3.10rc1 or later). This ensures that the arguments of expressions are evaluated in the correct order, preventing potential side effects.
There are no specific workarounds mentioned for this vulnerability. It is recommended to update to the latest version of Vyper.
For more information about this vulnerability, you can refer to the official Vyper advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/vyper/PYSEC-2023-167.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
