CVE-2026-114118 | BDVDB-2026-394102 Detail

Description#

Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-21Record published in the CVE List.
2. Version 22026-10-27Most recent update recorded in the CVE List.