Bug 2558019 (CVE-2020-37288)

Summary: CVE-2020-37288 vyper: vyper: Denial of Service via invalid jump destination in nested loops
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Vyper. A remote attacker can cause a Denial of Service (DoS) against affected smart contracts by submitting transactions that invoke specific contract functions. Due to incorrect bytecode generation for return statements located inside loops within nested internal calls, the contract triggers an invalid jump destination. This condition causes an unexpected stack underflow that forces transactions to revert, disrupting contract operations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2565623    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-21 01:00:49 UTC 
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls unnecessarily, which in limited circumstances could enable denial of service against public contracts.