CVE-2020-37288 PUBLISHED

Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops

Assigner: VulnCheck
Reserved: 20.10.2026 Published: 21.10.2026 Updated: 21.10.2026

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.3

Product Status

Vendor vyperlang
Product vyper
Versions Default: unaffected
  • affected from 0.1.0b10 to 0.2.3 (excl.)
  • Version 0.2.3 is unaffected

Credits

  • iamdefinitelyahuman analyst

References

Problem Types

  • Always-Incorrect Control Flow Implementation CWE