---
id: "CVE-2020-37289"
kind: "vulnerability"
aliases: ["CVE-2020-37289"]
title: "Vyper: uint8 return values from interfaces skip bounds checks"
severity: "medium"
cvss: 6.3
epss: 0.00261
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ethereum", "package", "smart-contracts", "vyper"]
not_affected_if: ["no-external-uint8-calls", "vyper-0.3.1-or-later"]
published_at: "2026-10-21T01:17:18+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:01:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37289", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-37289", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Vyper: uint8 return values from interfaces skip bounds checks

Vyper before 0.3.1 has no uint8 type, so interface functions declared to return uint8, such as ERC20.decimals(), are stored in uint256 without bounds checking. A malicious contract can return values above 255 and so manipulate or bypass logic that trusts those values.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `vyper --version` in each project that compiles Vyper contracts and check whether it is below `0.3.1`.
- Search the contracts for interfaces that declare `uint8` return values and that read from external or untrusted contracts.

## Fix

- Upgrade Vyper to `0.3.1` or later and recompile.
- Validate values returned from external contracts (for example, check that decimals are at most 255) before trusting them.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-37289
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-37289

## From the sources

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_