CVE-2026-114118Medium· 4.8▾ SunlitVyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive valu…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.
vyper >= 0.3.4 <= 0.5.0b1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2020-37288Low· 3.7Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
CVE-2020-37289Low· 3.7Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values
CVE-2020-37287Medium· 5.9Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments
CVE-2021-48018High· 7.4Vyper 0.2.13 before 0.2.15 Storage Corruption via @nonreentrant Decorator
CVE-2021-48019Medium· 4.8Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies