CVE-2023-32675 - CVE House
Back to Database
Status published Low CVE-2023-32675

Nonpayable default functions are sometimes payable in vyper

Vulnerability Description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, it is possible to send funds to the default function, even if the default function is marked `nonpayable`. This applies to contracts compiled with vyper versions prior to 0.3.8. This issue was fixed by the removal of the global `calldatasize` check in commit `02339dfda`. Users are advised to upgrade to version 0.3.8. Users unable to upgrade should avoid use of nonpayable default functions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32675

Credits & Attribution

No credits recorded in the NVD database.

References

More from vyperlang

View All →
CVE-2025-47774
Vyper's `slice()` may elide side-effects when output length is 0
Low 2.9
CVE-2025-47285
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Low 2.9
CVE-2025-27105
AugAssign evaluation order causing OOB write within the object in Vyper
Low 2.3
CVE-2025-27104
double eval in For List Iter in Vyper
Low 2.3
CVE-2025-26622
sqrt doesn't define rounding behavior in Vyper
Low 2.3

Affected Vendor

Affected Software

vyper
Vulnerable Versions:
< 0.3.8

Timeline

Official Publish: May 19th, 2023
Last Modified: February 12th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-670

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.