PROOF FIRST — SAMPLE DEFECT REPORT

ID
VF-PC-001

Classification
Historical public positive control. Fixed upstream. Never claimed as a new finding or
bounty submission.

Title
Zero-length concat argument can elide an expression side effect in Vyper v0.4.1

Environment
- Vulnerable control: Vyper v0.4.1
- Corrected control: Vyper v0.4.3
- Optimizer mode used by the positive-control check: gas
- Local EVM backend: REVM

Precondition
Deploy the public positive-control contract with counter initialized to 0. Its external
test() function calls concat() with a zero-length first argument produced by an
expression that increments counter.

Steps to reproduce
1. Compile the positive-control contract with Vyper v0.4.1.
2. Deploy the bytecode to the local REVM environment.
3. Read counter; confirm the value is 0.
4. Call test().
5. Read the returned bytes and counter again.
6. Repeat the same procedure with Vyper v0.4.3.

Expected behavior
The expression supplying the zero-length concat argument is evaluated. test() returns
"aaaa" and counter changes from 0 to 1.

Actual behavior in v0.4.1
test() returns "aaaa", but counter remains 0. The zero-length result is optimized away
with its side effect, producing an observable semantic mismatch.

Corrected behavior in v0.4.3
test() returns "aaaa" and counter changes from 0 to 1.

Impact
Source-level side effects may not occur even though contract execution succeeds and the
returned bytes appear correct. This positive control demonstrates why return-only checks
are insufficient; state changes must also be part of the oracle.

Disposition
Publicly fixed historical issue. The lab detected the vulnerable behavior and confirmed
the corrected behavior, so it is suitable as a calibration control only.

Reference
Vyper advisory GHSA-vgf2-gvx8-xwc3