The vulnerability in Vyper before 0.3.1 stems from the absence of a uint8 type. Interface return values declared as uint8, such as ERC20.decimals(), are stored in uint256 variables without bounds checking. A malicious contract can return a value larger than 255, allowing the caller to manipulate or bypass logic that depends on these values. This flaw enables attackers to subvert contract behavior and (inferred) potentially conduct fraudulent transactions.

The issue affects all Vyper contracts compiled with vyperlang:vyper before version 0.3.1. Any deployment that relies on uint8 return values from external contracts is vulnerable.

The CVSS score of 6.3 indicates a medium severity issue. The lack of an EPSS score suggests no current exploitation data, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to interact with a malicious contract that returns out‑of‑range values, so exploitation is confined to smart‑contract interactions. The risk is primarily to the integrity of contract logic rather than to confidentiality or availability, but it could lead to significant financial loss.