vyper vulnerabilities

CVEs whose affected-version data names the vyper package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

vyper vulnerabilities

Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Vyper's `slice()` may elide side-effects when output length is 0

Vyper Does Not Check the Success of Certain Precompile Calls

Vyper negative array index bounds checks

Vyper sha3 codegen bug

Vyper's external calls can overflow return data to return input buffer

Vyper's bounds check on built-in `slice()` function can be overflowed

Vyper's raw_call `value=` kwargs not disabled for static and delegate calls

concat built-in can corrupt memory in vyper

incorrect storage layout for contracts containing large arrays

Vyper has incorrect re-entrancy lock when key is empty string

incorrect order of evaluation of side effects for some builtins

Vyper has incorrectly allocated named re-entrancy locks

Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

Vyper vulnerable to integer overflow in loop

Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment

vyper vulnerable to storage allocator overflow

Incorrect success value returned in vyper

Memory corruption when returning a literal struct with a private call inside of it

missing clamps for decimal args in external functions