Name Shadowing Vulnerability in Vyper by VyperLang

CVE-2026-114663

What is CVE-2026-114663?

The vulnerability in Vyper versions 0.4.0b1 through 0.5.0b1 arises from the miscompilation of unfoldable constants and omitted default arguments from imported modules. This issue occurs because the names are resolved within the using function's scope, rather than being defined at the time of declaration. As a result, when a contract's parameter, local, or loop variable shares a name with an imported constant, malicious input can overwrite the expected values. This can lead to unintended behaviors like out-of-range values for narrow types, such as uint8, thus corrupting validation or accounting processes in smart contracts.

References