Description
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vyperlang | vyper | < 0.2.9 | 0.2.9 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | vyper | < 0.2.9 | 0.2.9 | GHSA-375m-5fvv-xq23 |
References
- GitHub Security Advisory (GHSA-375m-5fvv-xq23) vendor-advisory
- VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies third-party-advisory