Live › vulnerability › CVE-2021-48019
Go to dashboardVyper versions before 0.2.9 deploy forwarder proxies via create_forwarder_to that report a fixed 4096-byte RETURNDATASIZE instead of the real return size. Calls through these proxies can return corrupted data for functions returning more than 4096 bytes, and strict return-size checks such as SafeERC20.safeTransfer can fail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams whose smart contracts were compiled with Vyper before 0.2.9 and that deploy forwarder proxies with the built-in create_forwarder_to function. The issue matters when proxied functions return more than 4096 bytes or when callers use strict return-size checks. Projects not using create_forwarder_to can skip it.
No product ranges from the sources yet.
vyper --version, and look for create_forwarder_to in the Vyper source.create_forwarder_to calls or forwarder proxies built by the Vyper compiler.0.2.9 or later and recompile contracts that use create_forwarder_to.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.
This page as .md · .json · in your agent: get_signal("CVE-2021-48019")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.