CVE-2020-37288 in Vyper
Summary
by MITRE • 10/21/2026
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Vyper compiler versions prior to 0.2.3 represents a critical code generation flaw within the internal function call stack management logic. Specifically, when an internal function is invoked two or more levels deep from the entry point and contains a return statement nested inside a for loop, the compiler fails to correctly manage the program counter and stack state during control flow transitions. This defect results in the generation of invalid jump destinations that lead to a stack underflow condition at runtime on the Ethereum Virtual Machine. The root cause lies in the improper handling of local variable scope and return address preservation when exiting nested loops within deeply called internal functions, causing the execution context to become corrupted upon termination of the loop or function.
From an operational perspective, this flaw primarily manifests as a denial of service against affected smart contracts rather than a direct data exfiltration or unauthorized access vector. When a contract invokes such a vulnerable internal function, the resulting stack underflow causes the transaction to revert immediately and unconditionally. This behavior prevents any subsequent code execution within that call path, effectively halting the intended functionality of the application logic dependent on these specific control structures. While the impact is generally limited to availability rather than confidentiality or integrity, it can be exploited by attackers who understand the contract structure to intentionally trigger this condition, thereby blocking legitimate users from interacting with public-facing endpoints that rely on the compromised internal functions.
This issue aligns closely with CWE-682, which describes Incorrect Calculation of Loop Iterations, as well as CWE-754 related to Improper Check for Unusual or Exceptional Conditions during code generation. In terms of offensive security frameworks, this vulnerability can be categorized under ATT&CK technique T1499, specifically Endpoint Denial of Service via application logic exploitation, although in the context of blockchain smart contracts, it serves as a mechanism to disrupt service availability by forcing transaction reverts through crafted inputs that trigger the specific code path. The severity is heightened because Vyper is often used for high-value DeFi protocols where reliability and predictability are paramount, making even localized denial of service events significant threats to user trust and asset security.
Mitigation strategies require immediate upgrading of the Vyper compiler to version 0.2.3 or later, which includes patches for this specific code generation bug in internal function return handling within loops. Developers should also conduct thorough static analysis reviews focusing on control flow complexity in deeply nested internal functions, particularly those involving iterative structures with early returns. Implementing comprehensive unit tests that cover edge cases involving loop termination and multi-level function calls can help detect such logic errors before deployment to mainnet networks. Additionally, adopting formal verification tools or rigorous peer review processes for critical contract components ensures that compiler-specific quirks do not introduce exploitable vulnerabilities into production environments.