CVE-2026-114118: Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in createfromblueprint by uint256 subtraction without first checking that codeoffset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling codeoffset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Projects are exposed if they use affected Vyper versions and have factory logic that calls create_from_blueprint with a code_offset an attacker can control. The impact is deployment of contracts with no runtime code, which can trap ETH and tokens sent to those contracts.
What does an attacker need to exploit it?
An attacker must be able to control the code_offset passed to create_from_blueprint. Exploitation relies on supplying a very large offset that triggers unsigned integer wraparound.
Are unaffected factory deployments possible?
The issue is specific to create_from_blueprint calls where code_offset is attacker-controlled. The provided information does not indicate that ordinary deployments without such control over code_offset are affected.
How can I identify potentially affected code?
Review contracts compiled with Vyper 0.3.4 through 0.5.0b1 for uses of create_from_blueprint. Prioritize factories that derive code_offset from external inputs or otherwise permit untrusted parties to influence it.