CVE-2020-37288

Received Received - Intake

Vyper Compiler Stack Underflow in Return Statement

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2020-37288

EUVD

EUVD-2020-31284

Affected Vendors & Products

Vendor	Product	Version / Range
vyperlang	vyper	0.1.0b10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Vyper programming language versions from 0.1.0b10 to before 0.2.3. It occurs when a return statement inside a for loop within an internal function called two or more levels deep generates incorrect bytecode. This leads to an invalid jump destination and a stack underflow, causing affected smart contracts to unnecessarily revert calls.

Detection Guidance

To detect this vulnerability, check the Vyper compiler version in use. Vulnerable versions are from 0.1.0b10 up to but not including 0.2.3. Run 'vyper --version' to identify the version. If the version is within the affected range, inspect smart contracts for return statements inside for loops within nested internal function calls.

Impact Analysis

The impact is limited but could cause transaction failures or, in rare cases, a denial-of-service attack on public contracts. Users may experience unnecessary reverts of transactions if they interact with affected contracts.

Compliance Impact

This vulnerability primarily causes unnecessary transaction reverts and potential denial of service in smart contracts due to incorrect bytecode generation. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than smart contract execution errors.

Mitigation Strategies

Upgrade Vyper to version 0.2.3 or later. If upgrading is not immediately possible, avoid using return statements inside for loops that are nested more than one level deep. Replace return statements with pass statements as a temporary workaround.

Hi! I’m here to help you understand CVE-2020-37288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...