{"id":"CVE-2026-114663","kind":"vulnerability","aliases":["CVE-2026-114663"],"related":[],"title":"Vyper compiler: imported constants resolve to wrong variable, corrupting contract logic","description":"Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.","summary":"Vyper >=0.4.0b1 (through 0.5.0b1 and master) compiles unfoldable imported constants and omitted default arguments in the using function's scope. A same-named parameter, local or loop variable from the calling contract replaces the intended value, even pushing out-of-range values into narrow types like uint8. The colliding declaration must be in an imported module, and the replaced expression must stay unfoldable. An external user controls the value only if the captured variable derives from user input. No patched release exists yet.","severity":"high","cvss":8.6,"epss":0.00136,"exploited":false,"exploited_at":null,"products":[{"name":"vyper","fixed":[],"affected":">= 0.4.0b1, <= 0.5.0b1 (and master 17e925db)","ecosystem":"pip"}],"ecosystems":["pip"],"tags":["compiler","ethereum","package","smart-contracts","vyper"],"not_affected_if":["constants-fully-folded","no-imported-modules","no-imported-modules-with-constants","no-name-collision","vyper-above-0.5.0b1","vyper-below-0.4.0b1"],"how_to_check":"Check the compiler version used to build your contracts: vyper --version, or pip show vyper (0.4.0b1 and later is affected). Then, in any contract that imports a module, look for imported constants (constant(...) not fully folded to literals) or default arguments (x: uint8 = E) whose names or inner names match a parameter, local or loop variable in the calling function. The PoC in the advisory shows the pattern: test(300) returns 300 instead of 0. Deployed bytecode must be recompiled to fix.","fix":"No fixed version as of 2026-10-23: the advisory says Patched versions: None. Workaround: use literal or fully folded values, or rename so no name collides anywhere in the expanded expressions. Passing a qualified immutable explicitly avoids default capture, but qualifying an unfoldable constant alone is not enough. Already deployed contracts need recompiling and redeploying or upgrading once a fix ships. Watch GHSA-2489-32vh-8rrc.","status":"open","published_at":"2026-10-22T02:16:58+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:39:20+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:39:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Vyper compiler: imported constants resolve to wrong variable, corrupting contract logic","impact":"high","summary":"Vyper 0.4.0b1 through 0.5.0b1 resolves imported constants and default arguments in the calling function's scope, so a local variable with the same name can replace the intended value. An attacker who controls input can push out-of-range values into narrow types such as uint8, corrupting validation or accounting logic in the compiled contract.","category":"package","who_cares":["vyper","smart-contracts","ethereum"],"confidence":0.6,"needs_auth":"unknown","worst_case":"contract validation or accounting logic is corrupted by attacker-influenced input","analyst_note":"Check the Vyper release notes and GitHub advisory for the patched version and whether the affected range is fully enumerated; NVD page alone gives no fix version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["vyper-below-0.4.0b1","vyper-above-0.5.0b1","no-imported-modules-with-constants"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000505,"input_tokens":2967,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Vyper release notes and GitHub advisory for the patched version and whether the affected range is fully enumerated; NVD page alone gives no fix version.","search":"'-114663':14A,17A '-2026':13A,16A '0.4.0':27B,114C '0.5.0':30B,117C 'account':182C 'argument':41B,125C 'attack':159C 'attacker-influenc':158C 'b1':28B,31B,115C,118C 'call':59B 'captur':102B 'collid':78B 'compil':2A,19B,34B 'constant':4A,37B,121C 'contract':10A,24B,60B,147C 'control':96B 'corrupt':9A,179C 'cve':12A,15A 'declar':79B,144C 'default':40B,124C 'deriv':104B 'ethereum':20B 'even':65B 'exist':111B 'express':89B 'extern':94B 'function':45B,138C 'import':3A,36B,84B,127C 'includ':167C 'influenc':160C 'input':107B,161C 'intend':63B,165C 'like':75B 'local':53B,150C 'logic':11A,183C 'loop':55B,152C 'master':33B 'miscompil':119C 'modul':85B,128C 'must':80B,90B 'name':51B,131C,134C,157C 'narrow':73B,174C 'omit':39B,123C 'out-of-rang':67B,168C 'packag':21B 'paramet':52B,149C 'pars':130C 'patch':109B 'push':66B 'rang':70B,171C 'rather':141C 'releas':110B 'replac':61B,88B,163C 'resolv':5A,132C 'same-nam':49B 'scope':47B,140C 'share':154C 'smart':23B 'smart-contract':22B 'stay':91B 'type':74B,175C 'uint8':76B,178C 'unfold':35B,92B,120C 'use':44B,137C 'user':95B,106B 'valid':180C 'valu':64B,71B,98B,166C,172C 'variabl':8A,56B,103B,153C 'vyper':1A,18A,25B,26B,113C 'wrong':7A 'yet':112B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114663","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114663","severity":null,"published_at":"2026-10-22T02:16:58+00:00","modified_at":"2026-10-23T15:17:27+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114663:509","url":null,"severity":null,"published_at":"2026-10-23T23:45:19+00:00","modified_at":"2026-10-23T23:45:19+00:00","first_seen_at":"2026-10-23T23:45:19+00:00","fetched_at":"2026-10-23T23:45:19+00:00","note":"Read GHSA-2489-32vh-8rrc (maintainer, Oct 7): no patched version; affects >=0.4.0b1 through master 17e925db. Latest release v0.5.0b1 is affected per CVE. PoC is inline in the advisory; no exploitation reported; no X chatter. GitHub rates it Moderate, CVE/VulnCheck 8.6 High; severity left unchanged."},{"source":"epss","external_id":"CVE-2026-114663","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114663","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2149,"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-2489-32vh-8rrc","title":"GHSA-2489-32vh-8rrc: Function variables can replace imported constant values and default arguments","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2150,"url":"https://www.vulncheck.com/advisories/vyper-0.4-0b1-through-0.5-0b1-name-shadowing-of-imported-constants-and-default-arguments","title":"VulnCheck: Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2151,"url":"https://github.com/vyperlang/vyper/releases","title":"vyperlang/vyper releases (latest v0.5.0b1)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}