CVE-2021-48019: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

Q: Which deployments are exposed to this issue?

Deployments using Vyper versions before 0.2.9 that create forwarder proxies with the built-in create_forwarder_to function are affected. The issue applies to calls made through those proxies.

Q: What conditions are needed to trigger incorrect behavior?

A proxied function must return more than 4096 bytes without return-data sanitation, which can result in corrupted returned data. Calls can also fail when the caller enforces a strict return-size check, such as SafeERC20.safeTransfer.

Q: What is the practical impact of the incorrect return-data size?

The proxy reports a fixed RETURNDATASIZE of 4096 bytes instead of the actual size. This can corrupt large return values and cause strict return-size validation to fail, affecting integrity and availability of affected calls.

Published Oct 21, 2026

Updated

Vyper before 0.2.9 deploys forwarder proxies through the built-in createforwarderto function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

Affected Software

1 affected component

Vyper Vyper<0.2.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Vyper to a version that resolves this vulnerability.
Fixed in 0.2.9

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Vyper versions before 0.2.9 that create forwarder proxies with the built-in create_forwarder_to function are affected. The issue applies to calls made through those proxies.

What conditions are needed to trigger incorrect behavior?

A proxied function must return more than 4096 bytes without return-data sanitation, which can result in corrupted returned data. Calls can also fail when the caller enforces a strict return-size check, such as SafeERC20.safeTransfer.

What is the practical impact of the incorrect return-data size?

The proxy reports a fixed RETURNDATASIZE of 4096 bytes instead of the actual size. This can corrupt large return values and cause strict return-size validation to fail, affecting integrity and availability of affected calls.

CVE-2021-48019: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What conditions are needed to trigger incorrect behavior?

What is the practical impact of the incorrect return-data size?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What conditions are needed to trigger incorrect behavior?

What is the practical impact of the incorrect return-data size?