Bug 2565616

Summary: CVE-2020-37289 vyper: Vyper: Contract logic bypass via unvalidated interface return values [fedora-all]
Product: [Fedora] Fedora Reporter: TEJ RATHI <trathi>
Component: vyperAssignee: Peter Lemenkov <lemenkov>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: lemenkov
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["55e33b3c-696f-4e85-9517-5cb53a7aadef"]}
Fixed In Version: vyper-0.3.1 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-11-03 07:42:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2557998    

Description TEJ RATHI 2026-11-03 07:39:19 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.
Comment 1 Peter Lemenkov 2026-11-03 07:42:51 UTC 
This was fixed upstream in vyper 0.3.1 (GHSA-mr6r-mvw4-736g / VVE-2020-0001, published 2020-03-09).

All Fedora releases ship vyper 0.4.3, which already contains the fix and is not affected.