---
id: "CVE-2020-37288"
kind: "vulnerability"
aliases: ["CVE-2020-37288"]
title: "Vyper: return inside a for loop breaks internal calls, enabling contract denial of service"
severity: "medium"
cvss: 6.3
epss: 0.00284
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ethereum", "package", "smart-contracts", "vyper"]
not_affected_if: ["compiler-at-0.2.3-or-later", "no-return-in-for-loop"]
published_at: "2026-10-21T01:17:18+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:01:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37288", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-37288", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Vyper: return inside a for loop breaks internal calls, enabling contract denial of service

Vyper versions from 0.1.0b10 up to but not including 0.2.3 compile a return statement inside a for loop in an internal function, when that function is called two or more internal calls deep, into invalid bytecode. Affected contracts revert those calls, which in limited cases lets an attacker deny service to a public contract.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vyper compiler version used to build the contracts with `vyper --version`
- Search the repository for Vyper pragmas or build configs pinning a version below `0.2.3`
- Look for internal functions with a `return` inside a `for` loop that are called from other internal functions

## Fix

- Upgrade the Vyper compiler to `0.2.3` or later
- Recompile and redeploy affected contracts, since the bug is in the emitted bytecode

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-37288
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-37288

## From the sources

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_