-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0185
============================================================

Advisory-ID:  0xCERT-2026-0185
Severity:     Medium
Published:    2026-10-06T15:20:10.000Z
Updated:      2026-10-08T22:46:39.859Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0185

Title: Vyper: Return inside for loop more than 1 level deep

Summary
- -------
Vyper: Return inside for loop more than 1 level deep. Earlier today, we received a responsible disclosure of a potential issue from @michwill (developer of @curvefi) for Vyper users who use return statements inside for loops of nested internal calls.

Details
- -------
Summary
Earlier today, we received a responsible disclosure of a potential issue from @michwill (developer of @curvefi) for Vyper users who use return statements inside for loops of nested internal calls.

Affected
- - vyper (pip) >= 0.1.0b10, < 0.2.3 — fixed in 0.2.3

Severity
Medium (CVSS 6.3), as rated by the upstream advisory.

Recommended actions
- - Upgrade vyper to 0.2.3 or later

Source & attribution
This 0xCERT advisory summarises GHSA-vg88-3v92-rjx2 from the GitHub Advisory Database, credited upstream to iamdefinitelyahuman: https://github.com/advisories/GHSA-vg88-3v92-rjx2. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-vg88-3v92-rjx2
- - https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2
- - https://github.com/vyperlang/vyper/pull/2110
- - https://github.com/vyperlang/vyper/commit/a1d92e5eb968a34a23850359656aee23334adb90
- - https://github.com/vyperlang/vyper/releases/tag/v0.2.3

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIRjkJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcusGMCQsPFWlyZsMN7tOcCKH4tEBklo9DaNcsz
vnDINxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABnoQD8DajN8VQdzzP8Pxe3
ozk+tuGw36W6PRu9GtTHYerF+tMA/2aE/YxbUXzPsJvAiU0pAhemfoij/NMB
QAI8DJMEoS4E
=AGFF
-----END PGP SIGNATURE-----