# CVE-2021-48019: Vyper create_forwarder_to incorrect RETURNDATASIZE in proxies

Source: https://junglewise.ai/threats/cve-2021-48019-vyper-before-0-2-9-deploys-forwarder-proxies-through-the-built-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2021-48019 · Severity: medium · CVSS 4.8 · Published 2026-10-21

Vyper is a programming language for writing smart contracts on the Ethereum blockchain. Before version 0.2.9, Vyper's built-in function for creating forwarder proxy contracts reported an incorrect fixed return data size of 4096 bytes instead of the actual size. This can cause functions returning more than 4096 bytes to return corrupted data, or cause calls to fail when used with libraries that strictly validate return data size, such as SafeERC20.

Technologies: [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper). Vendors: [Vyper](https://junglewise.ai/threats/vendors/vyper).

## Quick answers

**Is CVE-2021-48019 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-48019 being exploited in the wild.

**How severe is CVE-2021-48019?** Medium severity, with a CVSS score of 4.8, published 21 October 2026.

**Which products and versions are affected?** Vyper before 0.2.9.

**Is there a fix for CVE-2021-48019?** Yes: fixed in 0.2.9. Until then: If calling contract methods expected to return ≤4096 bytes, the issue does not manifest as ABI decoders properly truncate data. For code using Solidity libraries that check RETURNDATASIZE (like SafeERC20.safeTransfer), perform greater-than-or-equal-to checks on return data size instead of strict equality checks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-48019 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-48019?** Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.2.9

If calling contract methods expected to return ≤4096 bytes, the issue does not manifest as ABI decoders properly truncate data. For code using Solidity libraries that check RETURNDATASIZE (like SafeERC20.safeTransfer), perform greater-than-or-equal-to checks on return data size instead of strict equality checks.

## Technical details

The create_forwarder_to function deployed forwarder proxies that hardcoded RETURNDATASIZE to 4096 bytes, regardless of actual return data. An attacker or user could trigger data corruption by calling functions through affected proxies that return more than 4096 bytes without explicit return data sanitation, or trigger assertion failures in downstream libraries performing strict RETURNDATASIZE checks. The vulnerability exists in all versions before 0.2.9 and was fixed by upgrading to EIP-1167 style forwarder proxies.

## Affected products

- Vyper Vyper before 0.2.9

## Timeline

- 2021-04-16: disclosed
- 2021: patched: Fixed in version 0.2.9 via upgrade to EIP-1167 style proxies
- 2026-10-21: advisory

## References

- [https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23](https://github.com/vyperlang/vyper/security/advisories/GHSA-375m-5fvv-xq23)
- [https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies](https://www.vulncheck.com/advisories/vyper-before-0.2.9-incorrect-returndatasize-in-create-forwarder-to-proxies)

## Related threats

- [Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants)
- [Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint)
- [Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation)
- [Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds)
- [Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1)