---
id: CVE-2021-48019
title: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies
summary: >-
  Vyper before 0.2.9 deploys forwarder proxies through the built-in
  create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE
  rather than the actual return data size. Calls through these proxies can yield
  corrupted data whe…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-805
vendor: vyperlang
product: vyper
affected:
  - vyper < 0.2.9
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:18.960Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2021-48019'
references:
  - url: 'https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23'
    label: GitHub Security Advisory (GHSA-375m-5fvv-xq23)
  - url: >-
      https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies
    label: >-
      VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in
      create_forwarder_to Proxies
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.048Z'
---

## Overview

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

## Affected

- `vyper < 0.2.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.