Vyper before 0.2.9 contains a flaw in its create_forwarder_to function, where forwarder proxies report a static return data size of 4096 bytes instead of the actual size of the data returned by the proxied function. When a proxied call returns more than 4096 bytes, callers receive truncated or corrupted payloads. The incorrect size flag also triggers failure in libraries that enforce strict return‑size checks such as SafeERC20.safeTransfer, leading to transaction rejection or erratic behavior. The weakness corresponds to buffer access errors (CWE‑805) and data integrity issues (CWE‑130) that affect the reliability of contract calls rather than providing direct execution.

The vulnerability impacts the Vyper compiler and runtime (vyperlang:vyper). Any Vyper release older than 0.2.9 that uses create_forwarder_to is affected, including all 0.2.x versions prior to 0.2.9.

The CVSS score of 6.3 indicates moderate severity. Because exploitation requires deploying a vulnerable proxy and invoking a function that returns more than 4096 bytes, the attack vector is bounded to internal contract interactions and there is no evidence of remote exploitation. The EPSS score of < 1% suggests a very low likelihood of public exploitation, and the vulnerability is not listed in CISA KEV. Nevertheless, the risk of data corruption or transaction failures in contracts that rely on strict return‑size checks warrants prompt mitigation.