double eval in For List Iter in Vyper

Vulnerability

Overview

CVE-2025-27104 describes a code generation flaw in the Vyper smart contract language where the iterator target of a for loop can be evaluated multiple times. While the iterator expression itself cannot produce multiple writes, it can consume side effects generated by the loop body, such as reading a storage variable that is updated inside the loop. This issue specifically affects static arrays (SArray) used as iterables; for dynamic arrays, the compiler panics and prevents exploitation [1][3].

Exploitation

Mechanism

The root cause lies in the Vyper compiler's handling of for loops with SArray iterators. During code generation, the iter_list expression is placed inside the body of a repeat IR instruction, causing it to be re-evaluated on each iteration. An attacker can craft a loop where the iterator contains an ifexp (e.g., for s: uint256 in ([read(), read()] if True else [])) that reads a storage variable. If that variable is modified within the loop body, the reads interleave with writes, leading to unexpected program behavior [3].

Impact

An attacker who can influence the contract's logic to include such a loop can cause the contract to behave in unintended ways. Although the iterator cannot write to storage, it can observe state changes that occur during loop execution, potentially enabling manipulation of contract state or bypassing intended constraints. This could lead to financial loss or incorrect contract execution [1][3].

Mitigation

The Vyper team has addressed this issue in version 0.4.1. Users are strongly advised to upgrade as soon as the patched release is available. No known workarounds exist for this vulnerability [1][3].