{"id":"CVE-2026-114118","kind":"vulnerability","aliases":["CVE-2026-114118"],"related":[],"title":"Vyper: blueprint deploy lets bad offset create empty contracts, trapping funds","description":"Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.","summary":"Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint with unchecked uint256 subtraction, so a large code_offset wraps to a small positive value. An attacker who controls code_offset can make a factory deploy contracts with no runtime code, which can trap ETH and tokens sent to them.","severity":"medium","cvss":6.3,"epss":0.00201,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ethereum","factory-contracts","package","smart-contracts","vyper"],"not_affected_if":["no-create-from-blueprint","offset-not-user-controlled","other-vyper-version"],"how_to_check":"- Check the Vyper version in the project, for example with `vyper --version` or the pinned version in the lockfile or build config, and see whether it falls in 0.3.4 through 0.5.0b1.\n- Search the contracts for `create_from_blueprint` and check whether `code_offset` can come from user input or an untrusted caller.","fix":"- Move Vyper to a version after 0.5.0b1; the sources do not name the fixed release, so check the Vyper release notes.\n- Until upgraded, validate or restrict `code_offset` in factory contracts so it is always below the blueprint code size.","status":"open","published_at":"2026-10-21T01:17:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:01:21+00:00","updated_at":"2026-10-25T04:01:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:01:21Z","model":"claude-haiku-5-5","output":{"fix":"- Move Vyper to a version after 0.5.0b1; the sources do not name the fixed release, so check the Vyper release notes.\n- Until upgraded, validate or restrict `code_offset` in factory contracts so it is always below the blueprint code size.","reach":"internet","title":"Vyper: blueprint deploy lets bad offset create empty contracts, trapping funds","impact":"medium","summary":"Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint with unchecked uint256 subtraction, so a large code_offset wraps to a small positive value. An attacker who controls code_offset can make a factory deploy contracts with no runtime code, which can trap ETH and tokens sent to them.","category":"package","nicknames":[],"who_cares":["vyper","smart-contracts","ethereum","factory-contracts"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Factory deploys empty contracts, trapping ETH and tokens sent to them.","analyst_note":"Confirm the fixed Vyper release and whether the caller-controlled code_offset path needs special factory design; check the NVD entry for the vector.","how_to_check":"- Check the Vyper version in the project, for example with `vyper --version` or the pinned version in the lockfile or build config, and see whether it falls in 0.3.4 through 0.5.0b1.\n- Search the contracts for `create_from_blueprint` and check whether `code_offset` can come from user input or an untrusted caller.","needs_analyst":true,"not_affected_if":["other-vyper-version","no-create-from-blueprint","offset-not-user-controlled"],"who_is_affected":"Teams that compile contracts with Vyper 0.3.4 through 0.5.0b1 and use blueprints with create_from_blueprint in a factory where the caller can influence code_offset. Contracts compiled with other Vyper versions, or factories that do not accept a caller-supplied offset, are less exposed. unknown for whether any specific production contract is deployed this way.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":3400,"output_tokens":746,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114118':14A,17A '-2026':13A,16A '0.3.4':28B,80C '0.5.0':30B,82C 'attack':57B,120C 'b1':31B,83C 'bad':5A 'blueprint':2A,35B,40B,87C,92C,105C 'check':98C 'code':48B,60B,71B,100C,107C,122C,133C 'comput':32B,84C 'contract':9A,21B,25B,67B,129C 'control':59B,121C 'creat':7A,38B,90C 'cve':12A,15A 'deploy':3A,66B,128C 'empti':8A 'eth':75B,136C 'ethereum':18B 'factori':20B,65B,127C 'factory-contract':19B 'first':97C 'fund':11A 'huge':111C 'larg':47B 'let':4A 'make':63B,125C 'offset':6A,49B,61B,101C,112C,123C 'packag':22B 'posit':54B,117C 'potenti':134C 'remain':34B,86C 'runtim':70B,132C 'sent':78B 'size':36B,88C,108C 'small':53B,116C 'smart':24B 'smart-contract':23B 'subtract':44B,95C 'token':77B,138C 'trap':10A,74B,135C 'uint256':43B,94C 'uncheck':42B 'valu':55B,118C 'vyper':1A,26B,27B,79C 'without':96C 'wrap':50B,113C","nicknames":[],"mitigations":[],"who_affected":"Teams that compile contracts with Vyper 0.3.4 through 0.5.0b1 and use blueprints with create_from_blueprint in a factory where the caller can influence code_offset. Contracts compiled with other Vyper versions, or factories that do not accept a caller-supplied offset, are less exposed. unknown for whether any specific production contract is deployed this way.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114118","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114118","severity":null,"published_at":"2026-10-21T01:17:38+00:00","modified_at":"2026-10-22T17:00:33+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114118","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114118","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}