CVE-2023-30629 - CVE House
Back to Database
Status published High CVE-2023-30629

Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value

Vulnerability Description

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`. A patch is available and, as of time of publication, anticipated to be part of Vyper 0.3.8. As a workaround, one may always put `max_outsize>0`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-30629

Credits & Attribution

No credits recorded in the NVD database.

References

More from vyperlang

View All →
CVE-2025-47774
Vyper's `slice()` may elide side-effects when output length is 0
Low 2.9
CVE-2025-47285
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Low 2.9
CVE-2025-27105
AugAssign evaluation order causing OOB write within the object in Vyper
Low 2.3
CVE-2025-27104
double eval in For List Iter in Vyper
Low 2.3
CVE-2025-26622
sqrt doesn't define rounding behavior in Vyper
Low 2.3

Affected Vendor

Affected Software

vyper
Vulnerable Versions:
>= 0.3.1, <= 0.3.7

Timeline

Official Publish: April 24th, 2023
Last Modified: February 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-670

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.