# Vyper return statement in nested for loops causes revert

Source: https://junglewise.ai/threats/vyper-return-inside-for-loop-more-than-1-level-deep-ee8a193d  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

Severity: medium · Published 2026-10-06

Vyper, a language for writing smart contracts on Ethereum-like blockchains, has a bug where return statements inside for loops within nested internal function calls cause transactions to revert unexpectedly. This could be exploited to create denial-of-service conditions in public contracts, preventing legitimate operations from completing.

Technologies: [vyper (PyPI)](https://junglewise.ai/threats/technologies/vyper), [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Vyper](https://junglewise.ai/threats/vendors/vyper).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, published 6 October 2026.

**Which products and versions are affected?** vyper (PyPI) >= 0.1.0b10, < 0.2.3; Vyper before 0.2.3.

**Is there a fix for This vulnerability?** Yes: fixed in Vyper 0.2.3. Until then: Avoid placing return statements inside for loops in internal functions that are called from other internal functions; instead, move the return statement outside the loop. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run vyper (PyPI) or Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Vyper 0.2.3

Avoid placing return statements inside for loops in internal functions that are called from other internal functions; instead, move the return statement outside the loop.

## Technical details

The vulnerability occurs when a return statement is placed inside a for loop that is part of a nested internal function call chain (2+ levels deep), resulting in an invalid jump destination that causes a stack underflow. The issue affects code patterns where internal functions call other internal functions that contain return statements in loops. A fix exists in Vyper 0.2.3 and was patched in PR #2110.

## Affected products

- Vyper Vyper before 0.2.3

## Timeline

- 2026-10-06: disclosed
- 2026-10-06: patched: Fixed in Vyper 0.2.3 via PR #2110

## Related threats

- [Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants)
- [Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint)
- [Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation)
- [Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds)
- [Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1)