Live › vulnerability › CVE-2020-37287
Go to dashboardVyper versions before 0.2.6 corrupt the call stack when multi-dimensional arrays or structs are passed as arguments, so functions receive wrong values. An attacker who can influence those inputs can make a contract act on incorrect data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that compile smart contracts with Vyper before 0.2.6 are exposed, especially contracts that pass multi-dimensional arrays or structs to internal or external functions. Projects using only base-type arguments or a newer compiler can skip it.
No product ranges from the sources yet.
vyper --version and check whether it is below 0.2.60.2.60.2.6 or later and recompile contractsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.
This page as .md · .json · in your agent: get_signal("CVE-2020-37287")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.