CVE-2020-37289

CVSS 6.3 (medium) · published 2026-10-21

Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to be stored in uint256 variables without bounds checking. Malicious contracts can return values greater than 255 to manipulate or bypass contract logic that relies on these values.

Weakness: CWE-20

Source: NVD CVE-2020-37289

References

• https://github.com/vyperlang/vyper/security/advisories/GHSA-mr6r-mvw4-736g
• https://www.vulncheck.com/advisories/vyper-before-0.3.1-improper-input-validation-of-uint8-interface-return-values

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.