Vyper

Vyper is a Pythonic, security-first programming language for smart contracts on the Ethereum Virtual Machine (EVM). Where most languages compete by adding features, Vyper competes by removing them: it has no inheritance, no function modifiers, no operator overloading, no inline assembly, and no recursion. Every omission serves the same goal — contracts that are simple to write, hard to get wrong, and easy for a human auditor to read. Conceived by Ethereum co-founder Vitalik Buterin and developed in the open since late 2016, Vyper has become what is widely regarded as the second language of the EVM ecosystem: far smaller than Solidity, but entrusted with billions of dollars of value through protocols like Curve Finance and Yearn.

History & Origins

Vyper’s story begins with Serpent, an early Python-like language for Ethereum contracts that Vitalik Buterin had created in the platform’s formative years. Serpent was concise but primitive — untyped, thinly specified, and implemented in a compiler that a 2017 security audit found to be seriously flawed. Buterin had already started on a successor: in November 2016 he created a new compiler repository under the Ethereum GitHub organization named Viper, describing it as a fundamentally redesigned, backwards-incompatible follow-up to Serpent.

Through 2017, Buterin publicly discussed Viper as the next-generation Pythonic language for the EVM, and stewardship passed from him to a team of volunteer contributors. Along the way the project was renamed Vyper — same snake, different spelling — and it has been maintained by an independent team (today under the vyperlang organization) ever since. The docs still credit it as “originally created by Vitalik Buterin.”

The language got its production baptism early. In 2018, Hayden Adams — encouraged by Buterin, who suggested both the language and an Ethereum Foundation grant — rewrote his prototype exchange in Vyper. That project, Uniswap V1, deployed to mainnet on November 2, 2018, months after Vyper’s first beta release (v0.1.0-beta.1, June 2018), and demonstrated that the young language could carry real value. In January 2020, Curve Finance launched with its core contracts in Vyper and grew into the language’s flagship: for years the majority of value secured by Vyper code has lived in Curve’s pools.

Design Philosophy

Vyper’s documentation states its priorities in order: security, language and compiler simplicity, and auditability. The guiding question is not “what can the programmer express?” but “what can a reader verify?” — the language aims to make it maximally difficult to write misleading code and to keep contracts readable even for users who have never written a line of Vyper.

This philosophy is most visible in what the language deliberately refuses to include:

• No inheritance. Solidity contracts often scatter behavior across a multi-level inheritance graph; understanding one function can require reading five files. A Vyper contract’s behavior is in the file in front of you.
• No function modifiers. Guard logic is written inline or in plain internal functions, where it can be read top to bottom rather than hidden behind a decorator defined elsewhere.
• No inline assembly. Dropping to raw EVM opcodes escapes every safety guarantee the language provides, so it simply isn’t allowed.
• No recursion and no infinite loops. Loops must have statically known bounds. This makes it possible to compute a precise upper bound on the gas consumption of any function call — ruling out gas-related attack surfaces and surprises.
• No operator overloading or function overloading, which can make innocent-looking expressions do surprising things.

The trade-off is explicit: Vyper does less than Solidity, on purpose, and its maintainers describe it as a complement to Solidity rather than a replacement.

Key Features

• Python-like syntax. Vyper is syntactically a (strict) subset-style dialect of Python — indentation-based blocks, def, for, type annotations — so it reads naturally to the world’s largest programming community, though it is not a general-purpose Python and cannot run Python code.
• Static, strong typing with value types like uint256, int128, bool, address, decimal (fixed-point, not floating-point), fixed-size byte arrays, bounded String/Bytes types, structs, and hash maps for contract storage.
• Built-in overflow and bounds checking. All arithmetic is checked and reverts on overflow or underflow, and array accesses are bounds-checked — behavior Solidity only adopted by default years later, in its 0.8.0 release.
• Native reentrancy protection via the @nonreentrant decorator, making one of the most notorious classes of smart contract exploits a one-line defense.
• Decidability. Because unbounded constructs are excluded, tooling can reason precisely about a contract’s behavior, including computing an upper bound on gas usage for any call.
• A module system (since 0.4.0) for code reuse through explicit imports and exports — recovering some of what inheritance provides, without the ambiguity.
• Modern tooling, most notably Titanoboa, the Vyper team’s interpreter and testing framework that lets developers execute and debug contracts in a Pythonic environment.

A minimal contract in modern (0.4.x) Vyper:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# pragma version ^0.4.0

greeting: public(String[100])

@deploy
def __init__(initial_greeting: String[100]):
    self.greeting = initial_greeting

@external
def set_greeting(new_greeting: String[100]):
    self.greeting = new_greeting

There is no class declaration and no inheritance list: one file is one contract, and the entire interface is visible at a glance.

Evolution

Vyper spent an unusually long time — by design and by necessity — in pre-1.0 territory, with several deliberate breaking overhauls:

• 0.1.0-beta era (2018–2019). The first beta shipped in June 2018; seventeen beta releases refined the core language while early adopters like Uniswap V1 proved it in production.
• 0.2.0 (July 2020) was a breaking redesign of syntax and semantics, establishing the shape of the modern language (explicit @external/@internal visibility decorators among other changes).
• 0.3.x (2021–2023) was the long workhorse series, culminating in 0.3.10 (October 2023), the standard compiler of Curve-era DeFi.
• 0.4.0 “Nagini” (June 2024) was the largest overhaul in the language’s history: a real module system for code reuse, the @deploy decorator for constructors, and Venom, a new intermediate representation enabling stronger optimization and analysis. Releases carry snake-themed codenames — a tradition already in place with 0.3.10 (“Black Adder”) and continued with “Nagini.”
• 0.4.1–0.4.3 (2025) refined the 0.4 line — 0.4.3 (June 2025) added the @raw_return decorator for proxy patterns and made Prague the default EVM target — while 0.5.0 alpha releases began shipping in mid-2026.

The 2023 Curve incident

No account of Vyper is complete without July 30, 2023. Attackers discovered that a compiler bug in Vyper versions 0.2.15, 0.2.16, and 0.3.0 caused the @nonreentrant lock mechanism to malfunction in certain configurations — the compiler could assign the locks in a way that failed to actually prevent reentrancy. Although the bug had been fixed back in version 0.3.1 in December 2021, several long-deployed Curve Finance pools and related protocols had been compiled with the vulnerable versions. Roughly $69 million was drained across affected pools, though a substantial portion was subsequently returned by whitehats or recovered.

The incident was a landmark for the whole industry: the vulnerability was not in any contract’s source code but in the compiler itself, meaning even a perfectly audited contract was exploitable. Vyper’s response reshaped the project — expanded security funding, third-party audits, and audit competitions for the compiler — and the episode pushed compiler-level security into the mainstream of smart contract risk assessment.

Current Relevance

Vyper today is a healthy niche language rather than a Solidity challenger. Solidity dominates EVM development by contract count and tooling breadth, but Vyper holds a durable second place with a distinct identity: it is the language of choice for teams — often Python-native quantitative and DeFi teams — who prize auditability over expressiveness. Curve Finance remains its anchor tenant, and the ecosystem around it includes the Titanoboa interpreter, the Ape and moccasin development frameworks, and first-class support in security tools.

The compiler is actively developed under the vyperlang organization, with the 0.4.x series stable, 0.5.0 in alpha as of mid-2026, and an official vyperlang/vyper Docker image for reproducible builds. Vyper also seeded a successor of sorts: Fe, another Ethereum language, began life as a Rust rewrite of the Vyper compiler before evolving its own direction.

Why It Matters

Vyper is one of the clearest real-world experiments in subtractive language design: the bet that in an adversarial, immutable, value-bearing environment, a language’s missing features can protect users better than its present ones. Ideas it built in from the start — checked arithmetic by default, bounded execution, first-class reentrancy protection — were vindicated as the broader ecosystem adopted them years later. And through the 2023 Curve incident, Vyper became the case study that taught the smart contract industry a hard lesson it now takes seriously: the compiler is part of your attack surface. For a language with a fraction of Solidity’s market share, that is an outsized mark on programming history.