Live › vulnerability › CVE-2021-48020
Go to dashboardVyper compiler versions from 0.1.0b4 before 0.3.0 generate incorrect stack tip handling when internal function calls appear inside arrays, external call arguments, struct literals, or raw_log topics. The result is memory corruption that makes deployed smart contracts behave incorrectly.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that compiled Vyper contracts with a compiler from 0.1.0b4 up to but not including 0.3.0 are exposed, and only when the contract code uses internal calls in one of the listed constructs. Projects that never used the affected Vyper versions or those constructs can skip it.
No product ranges from the sources yet.
vyper --version on the build machine, or the vyper version pinned in the project's requirements or lockfileraw_log topics0.3.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.
This page as .md · .json · in your agent: get_signal("CVE-2021-48020")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.