A return statement inside a for loop in an internal function that is called two or more internal calls deep causes Vyper to generate incorrect bytecode, resulting in an invalid jump destination and a stack underflow. The error leads to an unnecessary revert of the contract call, preventing the intended action from completing. The primary impact is a denial‑of‑service condition that can be triggered by malicious input to a public contract that relies on the vulnerable Vyper code. The weakness corresponds to CWE 670, reflecting improper consistency checks in the compiler.

The vulnerability affects Vyper versions 0.1.0b10 through 0.2.2. All contracts compiled with those Vyper releases and that call a vulnerable internal function deep within nested calls are affected. The issue is present in codebases that use libraries or inherit from other contracts where the offending return statement exists in a for loop. Vendors building decentralized applications on top of Vyper must verify the compiler version and the presence of such constructs.

The CVSS score of 6.3 classifies this as a medium‑severity vulnerability. Because the EPSS score is not available, the exploitation likelihood is currently unknown, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be “user‑initiated transaction” to a public contract that invokes a vulnerable internal method; a malicious actor could deliberately trigger the revert to cause a denial‑of‑service. The requirement for deep internal calls and a return inside a loop limits the attack surface, making exploitation less straightforward but still possible under the right conditions.