Vyper 0.3.4 through 0.5.0b1 contain a vulnerability in create_from_blueprint where the remaining blueprint size is calculated with unchecked uint256 subtraction; an attacker manipulating code_offset beyond the blueprint size triggers an unsigned wraparound that yields a small positive adjustment, causing the factory to deploy a contract with no runtime bytecode so that any ETH or tokens sent to the dead contract are trapped – a classic Unsigned Wraparound flaw (CWE‑681) that can result in financial loss for legitimate users.

Vyper 0.3.4 through 0.5.0b1 are affected; any factory using create_from_blueprint in these releases is at risk.

The CVSS score of 6.3 indicates a moderate threat level, and the EPSS score of <1 % shows a very low likelihood of widespread exploitation in the current landscape. Based on the description, it is inferred that the attack vector is that an attacker controlling the code_offset parameter can exploit the unchecked subtraction to cause a wraparound. Once such control is achieved, the attacker can deploy contracts that contain no runtime bytecode, enabling the capture of ETH and tokens sent to those contracts. The vulnerability remains on public Ethereum networks, making it accessible to anyone capable of interacting with a susceptible factory contract.