Memory Corruption Vulnerability in Vyper Package
Summary
GHSA-2r3x-4mrv-mcxf: Vyper: Memory corruption using function calls within tuples / nested calls. Affects vyper versions < 0.2.6. Fixed in 0.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Python-based programming language designed for writing smart contracts on the Ethereum blockchain. It emphasizes security and simplicity, making it a popular choice among developers for creating decentralized applications. However, Vyper has been found to have a memory corruption vulnerability that arises when function calls are made within tuples or as arguments in nested function calls.
Vulnerability Detail
The vulnerability originates from an incorrect pointer to the tip of the stack when performing function calls inside tuples or as arguments in nested calls. This can lead to memory corruption, potentially allowing attackers to manipulate the execution flow of the contract. The issue is particularly concerning as it can affect the integrity of the smart contract, leading to unintended behaviors or security breaches.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.6
This is the first release that contains the fix.
pip install --upgrade "vyper==0.2.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, avoid using function calls within tuples or as arguments in nested function calls until the package is updated. For example, refactor the code to separate function calls from tuple returns, as shown below:
@internal
def _foo(a: uint256, b: uint256, c: uint256) -> (uint256, uint256, uint256, uint256, uint256):
return 1, a, b, c, 5
@internal
def _foo2() -> uint256:
a: uint256[10] = [6,7,8,9,10,11,12,13,15,16]
return 4
@external
def foo() -> (uint256, uint256, uint256, uint256, uint256):
result = self._foo2()
return self._foo(2, 3, result)
Conclusion
In summary, the memory corruption vulnerability in the Vyper package poses significant risks to smart contract integrity. It is crucial for developers to update to version 0.2.6 or later to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for vyper →
FAQ
The vulnerability is a memory corruption issue that occurs when function calls are made inside tuples or as arguments in nested function calls.
Exploitation of this vulnerability can lead to unintended behaviors in smart contracts, potentially allowing attackers to manipulate contract execution.
You can use Vulert's playground to check for vulnerabilities in your application without requiring access to the code or installation.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
You can update the Vyper package to the patched version by running 'pip install vyper --upgrade' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
