CVE-2020-37286: Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

Q: Which contracts are affected by this issue?

Contracts compiled with Vyper versions from 0.1.0b4 up to, but not including, 0.3.0 are affected if they use internal function calls within tuples, nested calls, call arguments, or builtin arguments such as concat or ecrecover.

Q: What does exploitation require?

The vulnerable contract must contain the relevant nested internal-call pattern. The provided vector indicates network access, no privileges, and no user interaction are required, but exploitation has high attack complexity.

Q: What can happen if a vulnerable call pattern is reached?

The contract can return corrupted values or supply incorrect arguments to external calls. The stated impact includes integrity loss and limited availability impact, with no confidentiality impact.

Q: How can I determine whether a contract needs remediation?

Review the Vyper compiler version used for the contract and inspect its source for internal function calls used as tuple elements, nested calls, function-call arguments, or arguments to builtins such as concat and ecrecover. Contracts matching those patterns and compiled before 0.3.0 should be treated as affected.

Published Oct 21, 2026

Updated

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

Affected Software

1 affected component

Vyper Vyper>=0.1.0b4<0.3.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which contracts are affected by this issue?

Contracts compiled with Vyper versions from 0.1.0b4 up to, but not including, 0.3.0 are affected if they use internal function calls within tuples, nested calls, call arguments, or builtin arguments such as concat or ecrecover.

What does exploitation require?

The vulnerable contract must contain the relevant nested internal-call pattern. The provided vector indicates network access, no privileges, and no user interaction are required, but exploitation has high attack complexity.

What can happen if a vulnerable call pattern is reached?

The contract can return corrupted values or supply incorrect arguments to external calls. The stated impact includes integrity loss and limited availability impact, with no confidentiality impact.

How can I determine whether a contract needs remediation?

Review the Vyper compiler version used for the contract and inspect its source for internal function calls used as tuple elements, nested calls, function-call arguments, or arguments to builtins such as concat and ecrecover. Contracts matching those patterns and compiled before 0.3.0 should be treated as affected.

CVE-2020-37286: Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls

Affected Software

Event History

Frequently Asked Questions

Which contracts are affected by this issue?

What does exploitation require?

What can happen if a vulnerable call pattern is reached?

How can I determine whether a contract needs remediation?

Company

Resources

Contact

Frequently Asked Questions

Which contracts are affected by this issue?

What does exploitation require?

What can happen if a vulnerable call pattern is reached?

How can I determine whether a contract needs remediation?