CVE-2021-48020: Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

Q: Which contracts are affected by this issue?

Contracts compiled with Vyper versions from 0.1.0b4 through versions before 0.3.0 are affected if they place internal function calls in nested array elements, external call arguments, struct literals, or raw_log topics.

Q: What conditions are required for exploitation?

The vulnerable contract must contain an internal function call in one of the affected array-related contexts. The issue is remotely reachable and does not require attacker privileges or user interaction, but exploitation has high attack complexity.

Q: What is the impact of successful exploitation?

Memory corruption can cause incorrect contract behavior. The reported impact includes integrity loss and limited availability impact, with no reported confidentiality impact.

Q: How can teams identify potentially affected deployments?

Review the Vyper compiler version used to build deployed contracts and inspect source code for internal function calls within nested array elements, external call arguments, struct literals, or raw_log topics. Contracts compiled before 0.3.0 that use these patterns should be treated as potentially affected.

Published Oct 21, 2026

Updated

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or rawlog topics can have memory corrupted, producing incorrect contract behavior.

Affected Software

1 affected component

Vyper Vyper>=0.1.0b4<0.3.0

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which contracts are affected by this issue?

Contracts compiled with Vyper versions from 0.1.0b4 through versions before 0.3.0 are affected if they place internal function calls in nested array elements, external call arguments, struct literals, or raw_log topics.

What conditions are required for exploitation?

The vulnerable contract must contain an internal function call in one of the affected array-related contexts. The issue is remotely reachable and does not require attacker privileges or user interaction, but exploitation has high attack complexity.

What is the impact of successful exploitation?

Memory corruption can cause incorrect contract behavior. The reported impact includes integrity loss and limited availability impact, with no reported confidentiality impact.

How can teams identify potentially affected deployments?

Review the Vyper compiler version used to build deployed contracts and inspect source code for internal function calls within nested array elements, external call arguments, struct literals, or raw_log topics. Contracts compiled before 0.3.0 that use these patterns should be treated as potentially affected.

CVE-2021-48020: Vyper before 0.3.0 Memory Corruption via Internal Function Calls in Arrays

Affected Software

Event History

Frequently Asked Questions

Which contracts are affected by this issue?

What conditions are required for exploitation?

What is the impact of successful exploitation?

How can teams identify potentially affected deployments?

Company

Resources

Contact

Frequently Asked Questions

Which contracts are affected by this issue?

What conditions are required for exploitation?

What is the impact of successful exploitation?

How can teams identify potentially affected deployments?