Live › vulnerability › CVE-2021-48018
Go to dashboardVyper versions 0.2.13 before 0.2.15 place @nonreentrant lock storage slots on the same locations as ordinary contract storage variables. Calling a function marked @nonreentrant overwrites the overlapping variable, corrupting contract state and breaking its logic.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that compile Vyper contracts with the affected compiler range and use on functions, because the lock slot can collide with a state variable. Contracts compiled with Vyper outside 0.2.13 to 0.2.15, or that do not use , are not affected.
@nonreentrant@nonreentrantNo product ranges from the sources yet.
vyper --version or in the project's requirements or lockfile.@nonreentrant usage with grep -rn "@nonreentrant" contracts/.0.2.15 or later and recompile every contract that uses @nonreentrant.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.
This page as .md · .json · in your agent: get_signal("CVE-2021-48018")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.