Developers Say Bugs Found In Ethereum’s Vyper Compiler Are Not Critical

On January 8 the Ethereum (ETH) Foundation (EF) announced that the team is working on current implementation of Vyper compiler due to ”multiple serious bugs” in the code. The developers noted that the bugs did not influence smart contracts.

Vyper is an alternative programming language originally authored by Vitalik Buterin. It is designed to be as human-readable as possible even losing some important features of the main language, Solidity.

Being a part of the primary Ethereum (ETH) code stack, later it has become a separate repository, following preliminary audit performed by ConsenSys Diligence in October 2019. As reported, 31 issues were found in the Vyper compiler, the software which translates the language into machine code for the Ethereum Virtual Machine (EVM).

The EF team explained how their viewpoint about Vyper maintainers changed:

“After a few months of work we were skeptical that the python codebase was likely to deliver on the idea that Vyper promised. The codebase contained a significant amount of technical and architectural debt, and from our perspective it didn’t seem like the existing maintainers were focused on fixing this.”

Before rolling out the report EF developers started to work on another compiler based on the Rust language. This was done with regard to the upcoming EWASM, which will replace EVM with Ethereum 2.0.

Compiler bugs are not critircal, software maintainers claim

Bugs found in the Vyper compiler are especially critical, as it is a part of deposit contract, a crucial component of Ethereum 2.0 Proof-of-Stake algorithm.

However, Vyper team stated on Twitter that the deposit contract underwent a separate audit by Runtime Verification, and no bugs were found. During the analysis a compiled machine code was used, which means that any malfunction resulting from the compiler’s work would have been detected.

Interestingly, on January 7 Vyper developers stated that 75% of bugs found by ConsenSys audit were fixed.

Both Rust and Python versions of the compiler will be developed further, with an ultimate goal to bring both of them into a single Vyper language. This may require close cooperation of the two teams.