Vyper Vulnerability: Invalid Jump Destination Due to Return in Nested For Loops
Summary
GHSA-vg88-3v92-rjx2: Vyper: Return inside for loop more than 1 level deep. Affects vyper versions >= 0.1.0b10, < 0.2.3. Fixed in 0.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Python-based programming language designed for writing smart contracts on the Ethereum blockchain. It emphasizes security and simplicity, making it a popular choice among developers. However, Vyper has a known vulnerability that arises when return statements are used inside for loops of nested internal calls, leading to potential transaction reverts.
Vulnerability Detail
The vulnerability, identified as VVE-2020-0002, occurs when a return statement is placed inside a for loop that is nested more than one level deep within internal calls. This can result in an invalid jump destination, causing the transaction to revert unnecessarily. Although the impact is considered minor, it could lead to denial-of-service (DoS) attacks under specific conditions, particularly for public contracts. Developers using Vyper should be cautious when implementing nested calls with return statements.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.3
This is the first release that contains the fix.
pip install --upgrade "vyper==0.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using return statements inside for loops that are nested two or more levels deep. Instead, you can structure your code as follows:
@internal
def _baz():
for i in range(1):
pass
return # This works fine
@internal
def _bar():
self._baz()
@external
def foo():
self._bar()
Conclusion
The Vyper vulnerability related to return statements in nested for loops poses a risk of transaction reverts. Developers are encouraged to upgrade to the latest version to mitigate this issue and follow the provided workarounds if immediate upgrades are not feasible.
See every vulnerability recorded for vyper →
FAQ
The vulnerability involves invalid jump destinations caused by return statements within nested for loops, leading to unnecessary transaction reverts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 6.3, indicating a moderate level of severity.
If upgrading is not possible, ensure to avoid using return statements within nested for loops as a temporary workaround.
For more information, you can visit the Vyper GitHub repository or engage with the community on their Gitter channel.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
