---
id: CVE-2020-37288
aliases:
  - GHSA-vg88-3v92-rjx2
title: 'Vyper: Return inside for loop more than 1 level deep'
summary: 'Vyper: Return inside for loop more than 1 level deep'
severity: medium
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
vendor: vyper
product: vyper
ecosystem: pip
affected:
  - 'vyper >= 0.1.0b10, < 0.2.3'
patched:
  - vyper 0.2.3
published: '2026-10-06'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T02:56:09.007506586Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vg88-3v92-rjx2'
references:
  - url: 'https://github.com/vyperlang/vyper/security/advisories/GHSA-vg88-3v92-rjx2'
  - url: 'https://github.com/vyperlang/vyper/pull/2110'
  - url: >-
      https://github.com/vyperlang/vyper/commit/a1d92e5eb968a34a23850359656aee23334adb90
  - url: 'https://github.com/vyperlang/vyper'
  - url: 'https://github.com/vyperlang/vyper/releases/tag/v0.2.3'
  - url: >-
      https://www.vulncheck.com/advisories/vyper-0.1-0b10-before-0.2.3-invalid-jump-destination-via-return-in-nested-loops
    label: >-
      VulnCheck Advisory: Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination
      via Return in Nested Loops
tags:
  - osv
  - pip
  - cve.org
epss: 0.00347
epssPercentile: 0.28109
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-21T14:24:52.054926Z'
cvssSource: cna
cwe:
  - CWE-670
ingestedAt: '2026-10-21T01:37:08.050Z'
---

## Overview

# VVE-2020-0002
Earlier today, we received a responsible disclosure of a potential issue from @michwill (developer of @curvefi) for Vyper users who use return statements inside for loops of nested internal calls. Returning inside a for loop causes an invalid jump dest, reverting the transaction unnecessarily.

MWE:
```python
@internal
def _baz():
    for i in range(1):
        return  # Stack underflow happens here

@internal
def _bar():
    self._baz()

@external
def foo():
    self._bar()
```

### Impact
Impact is minor, it is unlikely a user would encounter this problem unless they were working with nested calls, and return statements inside calls. Even in that scenario, you would encounter a revert which should be noticeable with adequate testing. In limited circumstances, this could cause a DoS attack for public contracts under certain conditions.

### Patches
Fixed in https://github.com/vyperlang/vyper/pull/2110. Please upgrade to [Vyper 0.2.3](https://pypi.org/project/vyper/)

### Workarounds
Not returning inside a for loop nested 2+ internal calls deep works as is:
```python
@internal
def _baz():
    for i in range(1):
        pass
    return  # This works fine

@internal
def _bar():
    self._baz()

@external
def foo():
    self._bar()
```

### For more information
If you have any questions or comments about this advisory:
* Chat with us in [our gitter ](https://gitter.im/vyperlang/community)
* Open an issue in [https://github.com/vyperlang/vyper](https://github.com/vyperlang/vyper)
* Email us at [security@vyperlang.org](mailto:security@vyperlang.org)

## Affected packages

- `vyper >= 0.1.0b10, < 0.2.3`

## Remediation

Upgrade to a patched release:

- `vyper 0.2.3`