Vyper's `slice()` may elide side-effects when output length is 0
Impact
the slice() builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (msg.data or <address>.code). the reason is that for these source locations, the check that length >= 1 is skipped:
https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L315-L319
the result is that a 0-length bytestring constructed with slice can be passed to make_byte_array_copier, which elides evaluation of its source argument when the max length is 0:
https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/codegen/core.py#L189-L191
the impact is that side effects in the start argument may be elided when the length argument is 0, e.g. slice(msg.data, self.do_side_effect(), 0).
the following example illustrates how the issue would look in user code
counter: public(uint256)
@external
def test() -> Bytes[10]:
b: Bytes[10] = slice(msg.data, self.side_effect(), 0)
return b
def side_effect() -> uint256:
self.counter += 1
return 0the severity assigned is low, since this is not a very useful pattern and unlikely to be found in user code.
Patches
the fix is tracked in https://github.com/vyperlang/vyper/pull/4645, which disallows any invocation of slice() with length 0, including for the ad hoc locations discussed in this advisory.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
Are there any links users can visit to find out more?
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | vyper | <= 0.4.2rc1 | sin corrección |
Referencias
- https://github.com/vyperlang/vyper/security/advisories/GHSA-3vcg-j39x-cwfm
- https://nvd.nist.gov/vuln/detail/CVE-2025-47774
- https://github.com/vyperlang/vyper/pull/4645
- https://github.com/vyperlang/vyper
- https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/builtins/functions.py#L315-L319
- https://github.com/vyperlang/vyper/blob/68b68c4b30c5ef2f312b4674676170b8a6eaa316/vyper/codegen/core.py#L189-L191
- https://pypi.org/project/vyper
- https://github.com/advisories/GHSA-3vcg-j39x-cwfm
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P- Debilidad (CWE)
CWE-691- Plataforma
- Python (PyPI)
- Paquete
vyper- Publicada
- 16.05.2025
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-2028 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-3vcg-j39x-cwfm - CC BY 4.0
Historial de vulnerabilidades: vyper
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 47
- Primera → última
- 03.2020 10.2026
- Sin corrección
- 5
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 3
- Alta 14
- Media 20
- Baja 10
Divulgaciones por año
- 2020: 1
- 2021: 5
- 2022: 4
- 2023: 14
- 2024: 14
- 2025: 6
- 2026: 3
-
Vyper's `slice()` may elide side-effects when output length is 0 esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.