Live › vulnerability › CVE-2020-37288
Go to dashboardVyper versions from 0.1.0b10 up to but not including 0.2.3 compile a return statement inside a for loop in an internal function, when that function is called two or more internal calls deep, into invalid bytecode. Affected contracts revert those calls, which in limited cases lets an attacker deny service to a public contract.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that compile Vyper smart contracts with a compiler from 0.1.0b10 up to but not including 0.2.3, where an internal function with an early return inside a for loop is reached through two or more internal calls. Contracts built with newer compilers or without this code pattern are not affected.
No product ranges from the sources yet.
vyper --version0.2.3return inside a for loop that are called from other internal functions0.2.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.
This page as .md · .json · in your agent: get_signal("CVE-2020-37288")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.