Watch Your Language: Our First Vyper Audit

Summary: Trail of Bits audited Vyper contracts with Computable and found a compiler bug, concluding the Python-like language is too young to recommend for production. The review also found that function IDs derived from the first four bytes of the signature can collide - gsf() and tgeo() both produce 0x67e43e43 - so calling tgeo() executes gsf() code, a bug the Vyper team fixed in July after an initial fix missed the fallback-function case.
Why it matters: A four-byte function selector that silently routes one call into another contract's code is the perfect condition for a backdoored contract, and the compiler bug means the code you review may not be the code that runs.

Read the original at Trail of Bits Blog ↗