Bug 2557998 (CVE-2020-37289)

Summary: CVE-2020-37289 vyper: Vyper: Contract logic bypass via unvalidated interface return values
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Vyper. The compiler does not validate the upper bounds of smaller integer types returned from external contract interfaces, allowing 8-bit values to be stored in larger 256-bit variables without range verification. A malicious smart contract can exploit this flaw by returning out-of-range integer values, enabling an attacker to bypass business logic or manipulate calculations within contracts that rely on those values.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565616    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-21 00:58:49 UTC 
Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.