The concept behind the Vyper Venture was to develop one thing that was designed at the language stage to naturally exhibit a excessive diploma of security. The undertaking was initially authored by Vitalik as a proof-of-concept substitute for Serpent, its predecessor, however shortly after its creation Vyper discovered itself with out a devoted maintainer. Fortunately, there have been enthusiastic group members that took up the torch and continued growth of the undertaking, and we (the EF Python Group) turned re-involved in the undertaking for a while earlier this 12 months.
This fall, a preliminary safety audit was carried out by the Consensys Diligence workforce on the Python-based Vyper compiler. You can read the results for yourself here.
We encourage you to learn the report, nevertheless, there are two foremost take-aways.
- There are a number of severe bugs in the Vyper compiler.
- The codebase has a excessive stage of technical debt which can make addressing these points complicated.
Since the current Python-based Vyper implementation isn’t but manufacturing prepared, it has been moved out of the ethereum github group into its personal group: vyperlang. The prevailing maintainers are planning to deal with the points independently as soon as once more, however we’ll proceed to comply with the undertaking intently right here: >
In the meantime, our workforce continues work on a Rust-based compiler in tandem. Extra on that beneath, however first, right here’s a bit extra on how we obtained to the place we’re at the moment.
Over the course of this 12 months we labored with the undertaking maintainers to focus on bettering the code high quality and structure of the undertaking. After a couple of months of labor we had been skeptical that the python codebase was prone to ship on the concept that Vyper promised. The codebase contained a major quantity of technical and architectural debt, and from our perspective it did not look like the current maintainers had been targeted on fixing this.
Exploring Rust
Earlier this 12 months in August, we explored producing a model of the Vyper compiler constructed on essentially totally different structure. The purpose was to jot down a compiler in Rust that leverages the current work by the Solidity workforce and makes use of the YUL intermediate illustration to permit us to focus on EVM or EWASM throughout compilation. A Rust based mostly compiler might be simply compiled to WASM, making the compiler way more transportable than one based mostly in Python. By constructing on high of YUL we might get the EVM and EWASM compilation at no cost, solely requiring the compiler to deal with the transformation from a Vyper AST to YUL.
We had been sufficiently far together with our Rust based mostly Vyper compiler when the Python Vyper audit was launched, and had been assured in the directionl. The audit confirmed many issues round the python codebase and helped to validate the course we have taken.
The work continues
That mentioned, the maintainers of the Python Vyper codebase do intend to proceed with the undertaking. Whereas we don’t plan to have continued involvement in the python codebase, we want them luck but in addition needed to make be aware of current occasions to keep away from inadvertently signalling that the undertaking was protected to make use of.
So at current there are at the moment two “Vyper” compilers: The EF-supported work in the direction of constructing a compiler written in Rust to ship on the unique concept of Vyper, and the Python effort which can work independently towards the similar targets in the Python codebase. We’re hopeful that we will proceed working collectively in the direction of a single “Vyper” with a number of implementations, and we’ll hold everybody updated as the undertaking strikes ahead.
