CVE-2026-114663: Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Affected Software
Event History
Frequently Asked Questions
Which contracts are realistically exposed?
Exposure requires a contract to use imported modules with unfoldable constants or omitted default arguments and to have a parameter, local variable, or loop variable that shadows the relevant name in the calling function. Contracts without those name collisions are not described as affected.
What must an attacker be able to do to exploit the issue?
The attacker must be able to influence an input that is bound to a shadowing parameter, local, or loop variable. The supplied vector indicates no privileges or user interaction are required, while the attack vector is local.
How can teams identify potentially affected code?
Review contracts compiled with the affected releases for imported constants and imported functions called with omitted default arguments. Check whether names used by those imported declarations are reused as function parameters, local variables, or loop variables in the calling contract.
What security impact can result from a vulnerable name collision?
Attacker-controlled values can replace the intended imported constant or default value, which can corrupt validation or accounting logic. The description specifically notes that this can permit out-of-range values where narrow types such as uint8 were intended.