CVE-2026-114663 in Vyper
Summary
by MITRE • 10/22/2026
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name, attacker-influenced input can replace the intended value, including out-of-range values for narrow types such as uint8, corrupting validation or accounting logic.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Vyper compiler versions 0.4.0b1 through 0.5.0b1 represents a critical semantic error in how the language resolves variable names during compilation, specifically affecting constants and default arguments imported from external modules. This flaw stems from an incorrect implementation of name resolution within the parse_Name function, which erroneously binds identifiers to the scope of the calling function rather than preserving their original definition context at declaration time. In a properly functioning compiler for statically typed languages like Vyper, constant values and default parameter definitions should be resolved based on where they are defined in the module hierarchy, ensuring that their intrinsic properties remain immutable regardless of how or where they are invoked. However, due to this scope resolution bug, any variable within the consuming contract—whether it is a function parameter, a local variable, or part of an iteration loop—that shares the same identifier name as an imported constant or default argument will shadow and override that value during compilation.
This miscompilation creates a severe attack vector where malicious actors can manipulate smart contract behavior by exploiting naming collisions within their own codebase to alter fundamental logic constants. When a developer imports a module containing critical configuration values, such as maximum allowed limits for token transfers or specific mathematical bounds for financial calculations, these values are intended to be fixed at compile time. Instead, the compiler incorrectly substitutes these hardcoded values with whatever variable of the same name exists in the local scope of the function being executed. If an attacker can influence the input data that populates a loop counter, a user-supplied parameter, or any other locally scoped variable sharing that identifier, they effectively rewrite the contract's internal rules at runtime without triggering traditional reentrancy or overflow errors because the code itself has been fundamentally altered by the compiler to reflect these malicious inputs.
The operational impact of this vulnerability is particularly dangerous in financial smart contracts where precision and immutability are paramount. For instance, if a contract relies on an imported constant representing uint8 limits for validation checks, such as maximum transaction fees or quantity caps, the miscompilation allows an attacker to inject out-of-range values that bypass these safeguards. Since Vyper performs strict type checking at compile time based on declared types, one might assume safety is guaranteed; however, because the underlying value being checked has been swapped with a user-controlled variable of potentially different effective range or intent, standard validation logic fails silently. This corruption enables unauthorized state changes, fund drainage, or denial-of-service conditions by allowing inputs that should be rejected to pass through critical security gates, effectively neutralizing the protective measures designed into the contract architecture.
From a classification perspective, this issue aligns with CWE-754: Improper Check for Unusual or Exceptional Conditions and CWE-691: Use of Less Restrictive Type Constraint, as it involves a failure to correctly enforce type boundaries due to incorrect variable binding. In terms of the MITRE ATT&CK framework for blockchain systems, this vulnerability facilitates techniques related to Resource Hijacking and Defense Evasion by allowing attackers to bypass intended constraints through code manipulation rather than exploiting runtime execution flaws directly. The root cause is not in the logic flow but in the compilation phase's scope management, making it a subtle yet devastating flaw that undermines trust in statically compiled smart contracts.
Mitigation strategies must focus on immediate updates and rigorous development practices. Users of Vyper versions 0.4.0b1 through 0.5.0b1 should upgrade to patched releases where the parse_Name function has been corrected to properly isolate imported constants from local scopes. Developers should also adopt defensive coding standards by avoiding naming collisions between imported module identifiers and local variables, parameters, or loop counters. Utilizing unique prefixes for global configuration values can prevent accidental shadowing. Furthermore, static analysis tools and formal verification methods should be employed to detect scope resolution anomalies before deployment, ensuring that constant integrity is preserved across all function invocations within the smart contract ecosystem.