Vulnerability · Published Jan 14, 2025 · Assigned by GitHub_M

CVE-2025-21607Success of Certain Precompile Calls not Checked in Vyper

Low 2.3

In plain English

A low-severity security flaw in vyper from vyperlang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.7%top 47.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. This issue is fixed in 0.4.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	vyper	no fix listed	GHSA-vgf2-gvx8-xwc3
PyPI	vyper	0.4.1	PYSEC-2025-33

Affected products (as reported)

Vendor	Product	Versions
vyperlang	vyper	< 0.4.1

Weakness: CWE-670 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/vyperlang/vyper/security/advisories/GHSA-vgf2-gvx8-xwc3 x_refsource_CONFIRM
https://github.com/vyperlang/vyper/pull/4451 x_refsource_MISC
https://github.com/vyperlang/vyper/commit/7136eab0a254aa2ff7ddca41cc05f2ee1fa99caf x_refsource_MISC