VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
## Background @tjayrush reported a data handling issue with certain Web3 libraries using Vyper-deploy forwarder proxy contracts using our Vyper's built-in `create_forwarder_to` function prior to our change to support EIP-1167 style forwarder proxies. ### Impact If you are an end user of a forwarder-style proxy deployed using Vyper's built-in `create_forwarder_to` function AND you have a function that returns >4096 bytes AND you do no return data sanitation on the value returned, you could potentially see a data corruption issue. Otherwise, if you are handling the result of a return call AND you expect a specific `RETURNDATASIZE` that is less than 4096 (such as `SafeERC20.safeTransfer`) then the call will fail that check. ### Patches The issue was patched when we upgraded to EIP-1167 style forwarder proxies in #2281. ### Workarounds If you are making a call to a contract method that is expected to return <= 4096 bytes, there is no issue as the ABI decoders in both Solidity and Vyper will truncate the data properly. Web3 libraries will also do this, unless you are doing `eth_call` or `eth_sendTransaction` directly. If you are using a Solidity library that checks `RETURNDATASIZE` of an external call to a forwarder proxy deployed prior to this patch, it will fail on that assertion (such as `SafeERC20.safeTransfer`). The workaround is to always do a greater than or equal to check, rather than a strict equals to check.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | vyper (PyPI) | before 0.2.9 | 0.2.9 | Patch available | GHSA-375m-5fvv-xq23 |
- vyper (PyPI) Vendor— Affected before 0.2.9 Fixed in 0.2.9 Patch available GHSA-375m-5fvv-xq23
Remediation
- Fix · GHSA-375m-5fvv-xq23 vyper (PyPI) Fixed in 0.2.9 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-375m-5fvv-xq23
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences