Earlier today, we received a responsible disclosure of a potential issue from @michwill (developer of @curvefi) for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction unnecessarily.

MWE:

@internal
def baz():
  for i in range(1):
    return # Stack underflow happens here

@internal
def bar():
  self. baz()

@external
def foo():
  self. bar()

Impact is minor, it is unlikely a user would encounter this problem unless they were working with nested calls, and return statements inside calls. Even in that scenario, you would encounter a revert which should be noticeable with adequate testing. In limited circumstances, this could cause a DoS attack for public contracts under certain conditions.

Fixed in https://github.com/vyperlang/vyper/pull/2110. Please upgrade to Vyper 0.2.3

Not returning inside a for loop nested 2+ internal calls deep works as is:

@internal
def baz():
  for i in range(1):
    pass
  return # This works fine

@internal
def bar():
  self. baz()

@external
def foo():
  self. bar()

If you have any questions or comments about this advisory: