CVE-2025-21607 - CVE House
Back to Database
Status published Low CVE-2025-21607

Success of Certain Precompile Calls not Checked in Vyper

Vulnerability Description

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. This issue is fixed in 0.4.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-21607

Credits & Attribution

No credits recorded in the NVD database.

References

More from vyperlang

View All →
CVE-2025-47774
Vyper's `slice()` may elide side-effects when output length is 0
Low 2.9
CVE-2025-47285
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Low 2.9
CVE-2025-27105
AugAssign evaluation order causing OOB write within the object in Vyper
Low 2.3
CVE-2025-27104
double eval in For List Iter in Vyper
Low 2.3
CVE-2025-26622
sqrt doesn't define rounding behavior in Vyper
Low 2.3

Affected Vendor

Affected Software

vyper
Vulnerable Versions:
< 0.4.1

Timeline

Official Publish: January 14th, 2025
Last Modified: April 24th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-670

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.