{"id":"CVE-2020-37288","kind":"vulnerability","aliases":["CVE-2020-37288"],"related":[],"title":"Vyper: return inside a for loop breaks internal calls, enabling contract denial of service","description":"Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.","summary":"Vyper versions from 0.1.0b10 up to but not including 0.2.3 compile a return statement inside a for loop in an internal function, when that function is called two or more internal calls deep, into invalid bytecode. Affected contracts revert those calls, which in limited cases lets an attacker deny service to a public contract.","severity":"medium","cvss":6.3,"epss":0.00284,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ethereum","package","smart-contracts","vyper"],"not_affected_if":["compiler-at-0.2.3-or-later","no-return-in-for-loop"],"how_to_check":"- Check the Vyper compiler version used to build the contracts with `vyper --version`\n- Search the repository for Vyper pragmas or build configs pinning a version below `0.2.3`\n- Look for internal functions with a `return` inside a `for` loop that are called from other internal functions","fix":"- Upgrade the Vyper compiler to `0.2.3` or later\n- Recompile and redeploy affected contracts, since the bug is in the emitted bytecode","status":"open","published_at":"2026-10-21T01:17:18+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:01:28+00:00","updated_at":"2026-10-25T04:01:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:01:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Vyper compiler to `0.2.3` or later\n- Recompile and redeploy affected contracts, since the bug is in the emitted bytecode","reach":"internet","title":"Vyper: return inside a for loop breaks internal calls, enabling contract denial of service","impact":"low","summary":"Vyper versions from 0.1.0b10 up to but not including 0.2.3 compile a return statement inside a for loop in an internal function, when that function is called two or more internal calls deep, into invalid bytecode. Affected contracts revert those calls, which in limited cases lets an attacker deny service to a public contract.","category":"package","nicknames":[],"who_cares":["vyper","smart-contracts","ethereum"],"confidence":0.8,"needs_auth":"no","worst_case":"Public contract calls revert, causing denial of service","analyst_note":"","how_to_check":"- Check the Vyper compiler version used to build the contracts with `vyper --version`\n- Search the repository for Vyper pragmas or build configs pinning a version below `0.2.3`\n- Look for internal functions with a `return` inside a `for` loop that are called from other internal functions","needs_analyst":false,"not_affected_if":["compiler-at-0.2.3-or-later","no-return-in-for-loop"],"who_is_affected":"Teams that compile Vyper smart contracts with a compiler from 0.1.0b10 up to but not including 0.2.3, where an internal function with an early return inside a for loop is reached through two or more internal calls. Contracts built with newer compilers or without this code pattern are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3377,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2020':16A,19A '-37288':17A,20A '0.1.0':30B,84C '0.2.3':37B,87C 'affect':64B,117C 'attack':75B 'b10':31B,85C 'break':7A 'bytecod':63B 'call':9A,54B,59B,68B,103C,108C,121C 'case':72B 'circumst':126C 'code':90C 'compil':38B 'contract':11A,25B,65B,81B,118C,134C 'could':127C 'cve':15A,18A 'deep':60B,109C 'deni':76B 'denial':12A,129C 'destin':114C 'enabl':10A,128C 'ethereum':21B 'function':49B,52B,102C 'generat':88C 'includ':36B 'incorrect':89C 'insid':3A,42B,95C 'intern':8A,48B,58B,101C,107C 'invalid':62B,112C 'jump':113C 'let':73B 'limit':71B,125C 'loop':6A,45B,98C 'packag':22B 'produc':110C 'public':80B,133C 'return':2A,40B,93C 'revert':66B,119C 'servic':14A,77B,131C 'smart':24B 'smart-contract':23B 'stack':115C 'statement':41B,94C 'two':55B,104C 'underflow':116C 'unnecessarili':122C 'version':28B 'vyper':1A,26B,27B,82C","nicknames":[],"mitigations":[],"who_affected":"Teams that compile Vyper smart contracts with a compiler from 0.1.0b10 up to but not including 0.2.3, where an internal function with an early return inside a for loop is reached through two or more internal calls. Contracts built with newer compilers or without this code pattern are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2020-37288","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-37288","severity":null,"published_at":"2026-10-21T01:17:18+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2020-37288","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-37288","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}