CVE-2021-48019Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies

Description

Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data sanitation, and fail strict return-size checks such as SafeERC20.safeTransfer.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• GitHub Security Advisory (GHSA-375m-5fvv-xq23) vendor-advisory
• VulnCheck Advisory: Vyper before 0.2.9 Incorrect RETURNDATASIZE in create_forwarder_to Proxies third-party-advisory