CVE-2025-27104: Vyperlang Vyper Loop Iterator Vulnerability

CVE-2025-27104 Overview

CVE-2025-27104 affects Vyper, a Pythonic smart contract language for the Ethereum Virtual Machine (EVM). The vulnerability allows multiple evaluation of a single expression in the iterator target of a for loop. While the iterator expression itself cannot produce multiple writes, it can consume side effects produced by the loop body, such as reads of a storage variable updated during iteration. This interleaving of reads and writes leads to unexpected program behavior in deployed smart contracts. The issue affects iterators containing an ifexp construct as well as static arrays (SArray) instantiated within the body of a repeat IR.

Critical Impact
Smart contracts compiled with affected Vyper versions can exhibit unexpected runtime behavior due to interleaved reads and writes in for-loop iterators, potentially undermining contract correctness and security assumptions.

Affected Products

Vyperlang Vyper (all versions prior to 0.4.1)
Smart contracts compiled with affected Vyper releases targeting the EVM
Python-packaged distributions of vyperlang:vyper

Discovery Timeline

2025-02-21 - CVE-2025-27104 published to the National Vulnerability Database (NVD)
2025-03-28 - Last updated in NVD database

Technical Details for CVE-2025-27104

Vulnerability Analysis

The vulnerability is classified as an improper synchronization issue [CWE-662] in Vyper's code generation logic for for loops. Vyper supports two iterator target kinds: the range() builtin and iterable types such as SArray and DArray. During codegen, iterable lists must not produce side effects, and range_scope enforces this by parsing iter_list in a constant context validated against is_constant.

However, the constant-context check only prevents the iterator from producing side effects. It does not prevent the iterator from consuming side effects produced by the loop body. As a result, expressions inside the iterator can observe state changes that occur during iteration.

Root Cause

Two distinct code paths trigger the issue. First, iterators containing an ifexp, for example for s: uint256 in ([read(), read()] if True else []), may interleave reads with writes performed in the loop body. Second, for SArray iterators, iter_list is instantiated inside the body of a repeat IR node, causing it to be evaluated multiple times rather than once before iteration begins.

Attack Vector

A contract developer who writes code following normal Vyper semantics may produce a compiled contract whose runtime behavior diverges from the source-level intent. An attacker who can influence storage state read by the iterator, or who studies a deployed contract for the misbehavior pattern, can trigger logic divergences during execution. The flaw produces incorrect computation rather than direct memory corruption.

No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-h33q-mhmp-8p67 and the Vyper Pull Request #4488 for the compiler-level fix details.

Detection Methods for CVE-2025-27104

Indicators of Compromise

Deployed Vyper contracts compiled with versions prior to 0.4.1 that contain for loops iterating over list literals or SArray values
Source code patterns where iterator targets include ifexp expressions, for example for x in (list_a if cond else list_b)
On-chain transactions producing state transitions inconsistent with the contract's intended logic in iterated computations

Detection Strategies

Audit Vyper source repositories for for loops whose iterator target is not a range() call and that read storage or call functions with side effects
Run static analysis against the compiler version metadata embedded in build artifacts to flag contracts produced by vulnerable Vyper releases
Compare expected versus observed loop iteration counts and read values using simulation or fork-testing frameworks such as Foundry or Hardhat

Monitoring Recommendations

Track the compiler version field in CI/CD pipelines and reject builds using Vyper releases prior to 0.4.1
Monitor dependency manifests (requirements.txt, pyproject.toml) for pinned vulnerable vyper versions
Subscribe to the Vyper GitHub Security Advisories feed for follow-up disclosures related to codegen correctness

How to Mitigate CVE-2025-27104

Immediate Actions Required

Upgrade the Vyper compiler to version 0.4.1 or later in all development and build environments
Recompile and redeploy any production smart contracts built with affected Vyper versions after auditing for the vulnerable iterator patterns
Review existing on-chain contracts for for loops with ifexp iterators or SArray iteration combined with storage writes in the loop body

Patch Information

The fix is implemented in Vyper Pull Request #4488 and is expected in Vyper version 0.4.1. The patch adjusts codegen so that iterator lists are evaluated once and cannot consume side effects produced by the loop body. Full advisory text is available in the GitHub Security Advisory GHSA-h33q-mhmp-8p67.

Workarounds

No vendor-supplied workarounds are documented; upgrading the compiler is the only supported remediation
As a defensive coding practice, assign iterator lists to a local variable computed before the loop and iterate over that local to avoid ifexp or SArray re-evaluation
Restrict loop bodies from writing to storage that is also read by the iterator expression

bash

# Upgrade Vyper to the patched release once available
pip install --upgrade "vyper>=0.4.1"

# Verify the installed compiler version
vyper --version