Vyper Proxy Forwarder Return Data Size Corruption

Executive Summary

This vulnerability affects Vyper versions before 0.2.9. It involves forwarder proxies deployed via the create_forwarder_to function, which incorrectly reports a fixed 4096-byte RETURNDATASIZE instead of the actual return data size. When a function returns more than 4096 bytes without proper sanitization, it can lead to corrupted data and fail strict return-size checks like SafeERC20.safeTransfer.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Vyper version in use. If it is below 0.2.9, the system is potentially vulnerable. Inspect smart contracts for use of create_forwarder_to function in Vyper code. Review return data handling in contracts interacting with forwarder proxies to ensure no strict 4096-byte checks exist.

Useful 0 Not Useful 0

Impact Analysis

If you use Vyper versions before 0.2.9, calls through forwarder proxies may return corrupted data when functions exceed 4096 bytes. This can cause failures in contracts or libraries that rely on strict return-size checks, such as SafeERC20.safeTransfer, leading to unexpected behavior or errors.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts data integrity in smart contracts by causing corrupted return data when functions exceed 4096 bytes. While it does not directly violate GDPR or HIPAA, it could lead to incorrect data handling in systems subject to these regulations if the corrupted data affects personal or health information processing.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vyper to version 0.2.9 or later to switch to EIP-1167 style proxies. Review and update any strict return-size checks in contracts to use greater-than-or-equal-to comparisons instead of exact matches. Ensure return data sanitation is implemented for functions returning more than 4096 bytes.

Useful 0 Not Useful 0