Vyper: Name shadowing of imported constants and default arguments

Summary

Vyper versions 0.4.0b1 through 0.5.0b1 resolve names of imported constants and omitted default arguments in the scope of the calling function. If a parameter, local or loop variable has the same name, it can silently replace the intended value, including values outside the range of narrow types such as uint8. An attacker who controls such input can corrupt validation or accounting logic in a smart contract. Exploitation requires a matching name and an expression that cannot be folded at compile time.

Affected

• Vyper 0.4.0b1 through 0.5.0b1 (CVE record and VulnCheck)
• The GitHub advisory lists 0.4.0b1 and later up to master at commit 17e925db (not verified)

Fixed in

Unknown. No patched version is confirmed in the sources.

Workaround

• Use literal or fully folded values instead of unfoldable constants
• Avoid parameter, local and loop variable names that match names used in imported modules
• Pass a qualified immutable explicitly to avoid default capture

Qualifying an unfoldable constant alone is not sufficient.

Exploitation

• CISA SSVC: exploitation none, not automatable, total technical impact
• Not marked as known exploited
• VulDB reports no available exploit

Our recommendation

• Check whether your organisation or its clients develop, audit or host Vyper-based smart contracts; if not, no action needed beyond monitoring
• Avoid name collisions between contract variables and imported constants or default arguments
• Once a patched release appears, rebuild and re-verify compiled contracts that import modules, and review deployed contracts that handle validation or accounting

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-2489-32vh-8rrc github.com
• VulnCheck advisory www.vulncheck.com
• OSV CVE-2026-114663 osv.dev
• VulDB 425143 vuldb.com
• Vyper documentation: scoping and declarations docs.vyperlang.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:17.