Function Return Vulnerability in Vyper by Vyperlang

CVE-2020-37288

What is CVE-2020-37288?

Vyper versions 0.1.0b10 and earlier exhibit a flaw in generating code for return statements within nested for loops, especially when nested two or more calls deep. This results in an invalid jump destination, leading to stack underflow. Consequently, affected smart contracts may revert calls unnecessarily, potentially enabling denial of service attacks against public contracts under specific conditions. It highlights critical coding vulnerabilities that could be exploited if not addressed promptly.

References