Live › vulnerability › CVE-2020-37286
Go to dashboardVyper versions from 0.1.0b4 before 0.3.0 generate incorrect stack handling when internal function calls appear inside tuples or nested calls. Affected smart contracts can return corrupted values or pass wrong arguments to external calls.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that compile Vyper smart contracts with a compiler older than 0.3.0. Exposure depends on whether the contract code uses internal calls nested inside tuples, call arguments, or builtin arguments. Teams not using Vyper, or already on 0.3.0 or later, can skip it.
No product ranges from the sources yet.
vyper --version in the build environment and check whether it reports a version below 0.3.0.vyper pinned below 0.3.0.concat or ecrecover.0.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.
This page as .md · .json · in your agent: get_signal("CVE-2020-37286")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.