Execution Flaw in Vyper Smart Contract Language for EVM

CVE-2025-27104

Summary

The Vyper smart contract language for the Ethereum Virtual Machine (EVM) is susceptible to an execution flaw that involves multiple evaluations of a single expression in the iterator target of a for loop. Although the iterator expression itself does not allow for multiple writes, it can read side effects from the loop body, potentially causing erroneous results. Specifically, iterator reads that include conditional expressions may lead to interleaved read and write actions within the loop, resulting in unexpected behaviors in smart contract execution. Developers are strongly advised to upgrade to version 0.4.1, which is expected to resolve this issue, as there are no known workarounds available.

References