---
id: "CVE-2021-48018"
kind: "vulnerability"
aliases: ["CVE-2021-48018"]
title: "Vyper: reentrancy lock storage slots overwrite contract state variables"
severity: "high"
cvss: 8.3
epss: 0.00321
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ethereum", "package", "smart-contracts", "vyper"]
not_affected_if: ["compiled-with-vyper-0.2.15-or-later", "no-nonreentrant-usage"]
published_at: "2026-10-21T01:17:18+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:02:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-48018", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-48018", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Vyper: reentrancy lock storage slots overwrite contract state variables

Vyper versions 0.2.13 before 0.2.15 place @nonreentrant lock storage slots on the same locations as ordinary contract storage variables. Calling a function marked @nonreentrant overwrites the overlapping variable, corrupting contract state and breaking its logic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Vyper compiler version with `vyper --version` or in the project's requirements or lockfile.
- Search deployed or source contracts for `@nonreentrant` usage with `grep -rn "@nonreentrant" contracts/`.

## Fix

- Upgrade the Vyper compiler to `0.2.15` or later and recompile every contract that uses `@nonreentrant`.
- Redeploy affected contracts, since the bytecode layout of already-deployed contracts cannot be changed in place.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-48018
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-48018

## From the sources

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variables. When a function using @nonreentrant is called, setting the lock overwrites the overlapping storage variable, corrupting contract state and breaking the contract's intended logic.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_