Vyper Programming Language Vulnerability in Ethereum Virtual Machine

CVE-2025-47774

What is CVE-2025-47774?

In Vyper, a vulnerability exists within the slice() builtin that can inadvertently omit side effects when the output length is set to zero. This occurs specifically in versions up to and including 0.4.2rc1, where checks for the source bytestring length are bypassed, allowing a potential misuse in smart contracts. If the length argument is zero, side effects defined in the start argument may not be executed, potentially undermining the integrity of contract operations. This issue affects specific source locations like msg.data and <address>.code. A fix has been proposed in pull request 4645 to prevent any invocation of slice() with a length of zero.

References