The Vyper compiler in releases 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules because the parser resolves their names in the function’s scope rather than at declaration. As a result, if a contract parameter, local, or loop variable shares a name with an imported constant or default argument, an attacker‑influenced input can replace the intended value, including out‑of‑range values for narrow types such as uint8. This can corrupt validation or accounting logic, leading to both data integrity violations and potential financial loss.

Any smart contract compiled with Vyper versions 0.4.0b1 to 0.5.0b1 that imports constants or default arguments from another module and shadows those names in a function or variable. The affected product is the Vyper compiler provided by vyperlang; all contracts deployed with those versions are vulnerable.

The vulnerability has a CVSS score of 8.6, indicating high severity. The EPSS score is not available and the issue is not listed in CISA KEV. An attacker can influence the input to public contract functions or the deployment arguments of a vulnerable contract; no privileged access is required. Because the compiler produces miscompiled bytecode that accepts the attacker‑supplied values, exploitation is straightforward once a vulnerable contract is deployed, and the exploitation probability is high enough to warrant immediate patching.