Description
Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.
Metrics
CVSS 3.1 4.8/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:LWeakness enumeration
Affected software
No affected versions have been published.
Timeline
- Published
- Oct 21, 2026
- Last modified
- Oct 22, 2026
- NVD status
- Deferred