CVE-2023-42460: _abi_decode input not validated in complex expressions in Vyper

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-09-27 · updated 2026-06-17
Weakness: CWE-682

Description

Vyper is a Pythonic Smart Contract Language for the EVM. The `_abi_decode()` function does not validate input when it is nested in an expression. Uses of `_abi_decode()` can be constructed which allow for bounds checking to be bypassed resulting in incorrect results. This issue has not yet been fixed, but a fix is expected in release `0.3.10`. Users are advised to reference pull request #3626.

Affected products

vyperlang vyper: from 0.3.4 before 0.3.10 — fixed in 0.3.10

How to fix

Upgrade to a fixed version: vyperlang vyper 0.3.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-42460 or the next vulnerability affects your stack