CVE-2020-37289: Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values

Q: Which contracts are exposed to this issue?

Contracts compiled with Vyper before 0.3.1 are exposed if they call an external interface function declared to return uint8, store that result in a uint256 variable, and rely on the value for security-sensitive or correctness-critical logic.

Q: What does an attacker need to exploit it?

An attacker needs a malicious external contract that is called through an affected interface return path. That contract can return a value greater than 255, which may manipulate or bypass logic that assumes the returned value is constrained to the uint8 range.

Q: Are contracts affected by default?

No specific default configuration is identified. Exposure depends on using the affected Vyper versions and on contract logic that consumes uint8-declared interface return values without an effective range check.

Q: What can be done if recompiling with Vyper 0.3.1 or later is not immediately possible?

Review affected external interface return values and enforce an explicit maximum of 255 before using them in contract logic. Avoid relying on uint8 semantics when the returned value is stored as uint256 unless the bound is checked.

Published Oct 21, 2026

Updated

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.

Affected Software

1 affected component

Vyper Vyper<0.3.1

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which contracts are exposed to this issue?

Contracts compiled with Vyper before 0.3.1 are exposed if they call an external interface function declared to return uint8, store that result in a uint256 variable, and rely on the value for security-sensitive or correctness-critical logic.

What does an attacker need to exploit it?

An attacker needs a malicious external contract that is called through an affected interface return path. That contract can return a value greater than 255, which may manipulate or bypass logic that assumes the returned value is constrained to the uint8 range.

Are contracts affected by default?

No specific default configuration is identified. Exposure depends on using the affected Vyper versions and on contract logic that consumes uint8-declared interface return values without an effective range check.

What can be done if recompiling with Vyper 0.3.1 or later is not immediately possible?

Review affected external interface return values and enforce an explicit maximum of 255 before using them in contract logic. Avoid relying on uint8 semantics when the returned value is stored as uint256 unless the bound is checked.

CVE-2020-37289: Vyper before 0.3.1 Improper Input Validation of uint8 Interface Return Values

Affected Software

Event History

Frequently Asked Questions

Which contracts are exposed to this issue?

What does an attacker need to exploit it?

Are contracts affected by default?

What can be done if recompiling with Vyper 0.3.1 or later is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which contracts are exposed to this issue?

What does an attacker need to exploit it?

Are contracts affected by default?

What can be done if recompiling with Vyper 0.3.1 or later is not immediately possible?