{"id":"CVE-2021-48019","kind":"vulnerability","aliases":["CVE-2021-48019"],"related":[],"title":"Vyper: forwarder proxies misreport return size, corrupting large call results","description":"Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.","summary":"Vyper versions before 0.2.9 deploy forwarder proxies via create_forwarder_to that report a fixed 4096-byte RETURNDATASIZE instead of the real return size. Calls through these proxies can return corrupted data for functions returning more than 4096 bytes, and strict return-size checks such as SafeERC20.safeTransfer can fail.","severity":"medium","cvss":6.3,"epss":0.00248,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ethereum","package","smart-contracts","vyper"],"not_affected_if":["no-create-forwarder-to","vyper-0.2.9-or-later"],"how_to_check":"- Check the Vyper compiler version used in the project, for example with `vyper --version`, and look for `create_forwarder_to` in the Vyper source.\n- Search deployed or source contracts for `create_forwarder_to` calls or forwarder proxies built by the Vyper compiler.","fix":"- Upgrade Vyper to `0.2.9` or later and recompile contracts that use `create_forwarder_to`.","status":"open","published_at":"2026-10-21T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:01:25+00:00","updated_at":"2026-10-25T04:01:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:01:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Vyper to `0.2.9` or later and recompile contracts that use `create_forwarder_to`.","reach":"unknown","title":"Vyper: forwarder proxies misreport return size, corrupting large call results","impact":"medium","summary":"Vyper versions before 0.2.9 deploy forwarder proxies via create_forwarder_to that report a fixed 4096-byte RETURNDATASIZE instead of the real return size. Calls through these proxies can return corrupted data for functions returning more than 4096 bytes, and strict return-size checks such as SafeERC20.safeTransfer can fail.","category":"package","nicknames":[],"who_cares":["vyper","smart-contracts","ethereum"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Corrupted return data from proxied contract calls","analyst_note":"","how_to_check":"- Check the Vyper compiler version used in the project, for example with `vyper --version`, and look for `create_forwarder_to` in the Vyper source.\n- Search deployed or source contracts for `create_forwarder_to` calls or forwarder proxies built by the Vyper compiler.","needs_analyst":false,"not_affected_if":["vyper-0.2.9-or-later","no-create-forwarder-to"],"who_is_affected":"Teams whose smart contracts were compiled with Vyper before 0.2.9 and that deploy forwarder proxies with the built-in create_forwarder_to function. The issue matters when proxied functions return more than 4096 bytes or when callers use strict return-size checks. Projects not using create_forwarder_to can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3395,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2021':12A,15A '-48019':13A,16A '0.2.9':26B,75C '4096':38B,60B,92C,116C 'actual':98C 'built':82C 'built-in':81C 'byte':39B,61B,93C,117C 'call':9A,47B,102C 'check':67B,128C 'contract':21B 'corrupt':7A,53B,108C 'creat':31B,84C 'cve':11A,14A 'data':54B,100C,109C,120C 'deploy':27B,76C 'ethereum':17B 'fail':72B,123C 'fix':37B,91C 'forward':2A,28B,32B,77C,85C 'function':56B,87C,112C 'instead':41B 'larg':8A 'misreport':4A 'packag':18B 'proxi':3A,29B,50B,78C,105C 'rather':95C 'real':44B 'report':35B,89C 'result':10A 'return':5A,45B,52B,57B,65B,99C,113C,119C,126C 'return-s':64B,125C 'returndatas':40B,94C 'safeerc20.safetransfer':70B,131C 'sanit':121C 'size':6A,46B,66B,101C,127C 'smart':20B 'smart-contract':19B 'strict':63B,124C 'version':24B 'via':30B 'vyper':1A,22B,23B,73C 'without':118C 'yield':107C","nicknames":[],"mitigations":[],"who_affected":"Teams whose smart contracts were compiled with Vyper before 0.2.9 and that deploy forwarder proxies with the built-in create_forwarder_to function. The issue matters when proxied functions return more than 4096 bytes or when callers use strict return-size checks. Projects not using create_forwarder_to can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2021-48019","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48019","severity":null,"published_at":"2026-10-21T01:17:19+00:00","modified_at":"2026-10-22T17:00:33+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2021-48019","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48019","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}