The thought behind the Vyper challenge was to develop one thing that was designed on the language degree to naturally exhibit a excessive diploma of safety. The challenge was initially authored by Vitalik as a proof-of-concept substitute for Serpent, its predecessor, however shortly after its creation Vyper discovered itself with out a devoted maintainer. Luckily, there have been enthusiastic group members who took up the torch and continued to develop the challenge, and we (the EF Python staff) rejoined the challenge a while earlier this yr.
This fall, the Consensys Diligence staff carried out a preliminary safety audit on the Python-based Vyper compiler. You may learn the outcomes for your self right here.
We encourage you to learn the report, nevertheless, there are two major takeaways.
- There are a number of severe bugs within the Vyper compiler.
- The code base has a excessive degree of technical debt which can make fixing these issues advanced.
Because the current Python-based implementation of Vyper will not be but prepared for manufacturing, it has been moved from the ethereum github group to its personal group: vyperlang. The present maintainers plan to work on their very own once more, however we’ll proceed to maintain a detailed eye on the challenge right here: > https://github.com/vyperlang/vyper
In the meantime, our staff continues to work on a Rust-based compiler in tandem. Extra on that beneath, however first, this is a bit extra about how we obtained to the place we’re right this moment.
Throughout this yr, we labored with the challenge maintainers to concentrate on enhancing the code high quality and challenge structure. After just a few months of labor, we had been skeptical that the python codebase was prone to ship on the concept Vyper promised. The codebase contained a major quantity of technical and architectural debt, and from our perspective, the prevailing maintainers did not appear targeted on fixing it.
Exploring Rust
Earlier this yr, in August, we explored the manufacturing of a model of the Vyper translator constructed on a basically totally different structure. The purpose was to put in writing a compiler in Rust that makes use of current work from the Solidity staff and makes use of the YUL intermediate view to permit us to focus on EVM or EWASM throughout compilation. A Rust-based compiler will be simply compiled into WASM, making the compiler way more transportable than a Python-based compiler. By constructing on YUL we’d get EVM and EWASM compilation without spending a dime, it might simply require the compiler to deal with the transformation from Vyper AST to YUL. We had been far sufficient together with our Rust-based Vyper compiler when the Python Vyper revision was launched, and we had been assured within the route. The audit confirmed many issues in regards to the python codebase and helped affirm the route we had been headed.
The work continues
Nonetheless, the maintainers of the Python Vyper codebase intend to proceed with the challenge. Whereas now we have no plans to proceed contributing to the python codebase, we want them luck, but additionally need to observe current occasions to keep away from inadvertently signaling that the challenge is protected to make use of.
So there are presently two “Vyper” translators: an EF-supported effort to construct a translator written in Rust that can ship the unique Vyper concept, and a Python effort that can work independently towards the identical objectives within the Python codebase. We hope we will proceed to work collectively in the direction of a single “Vyper” with a number of deployments, and we’ll preserve everybody up to date because the challenge progresses.
