The thought behind the Vyper Undertaking was to develop one thing that was designed on the language degree to naturally exhibit a excessive diploma of security. The undertaking was initially authored by Vitalik as a proof-of-concept substitute for Serpent, its predecessor, however shortly after its creation Vyper discovered itself with out a devoted maintainer. Fortunately, there have been enthusiastic group members that took up the torch and continued improvement of the undertaking, and we (the EF Python Workforce) grew to become re-involved within the undertaking for a while earlier this yr.
This fall, a preliminary safety audit was carried out by the Consensys Diligence staff on the Python-based Vyper compiler. You’ll be able to learn the outcomes for your self right here.
We encourage you to learn the report, nevertheless, there are two predominant take-aways.
- There are a number of severe bugs within the Vyper compiler.
- The codebase has a excessive degree of technical debt which can make addressing these points complicated.
Because the current Python-based Vyper implementation will not be but manufacturing prepared, it has been moved out of the ethereum github group into its personal group: vyperlang. The prevailing maintainers are planning to deal with the problems independently as soon as once more, however we are going to proceed to comply with the undertaking intently right here: > https://github.com/vyperlang/vyper
In the meantime, our staff continues work on a Rust-based compiler in tandem. Extra on that under, however first, right here’s a bit extra on how we received to the place we’re at the moment.
Over the course of this yr we labored with the undertaking maintainers to deal with enhancing the code high quality and structure of the undertaking. After a number of months of labor we have been skeptical that the python codebase was prone to ship on the concept that Vyper promised. The codebase contained a major quantity of technical and architectural debt, and from our perspective it did not look like the prevailing maintainers have been targeted on fixing this.
Exploring Rust
Earlier this yr in August, we explored producing a model of the Vyper compiler constructed on essentially completely different structure. The purpose was to write down a compiler in Rust that leverages the prevailing work by the Solidity staff and makes use of the YUL intermediate illustration to permit us to focus on EVM or EWASM throughout compilation. A Rust based mostly compiler could be simply compiled to WASM, making the compiler far more transportable than one based mostly in Python. By constructing on prime of YUL we’d get the EVM and EWASM compilation without spending a dime, solely requiring the compiler to deal with the transformation from a Vyper AST to YUL.
We have been sufficiently far together with our Rust based mostly Vyper compiler when the Python Vyper audit was launched, and have been assured within the directionl. The audit confirmed many issues across the python codebase and helped to validate the path we have taken.
The work continues
That mentioned, the maintainers of the Python Vyper codebase do intend to proceed with the undertaking. Whereas we don’t plan to have continued involvement within the python codebase, we want them luck but in addition needed to make word of current occasions to keep away from inadvertently signalling that the undertaking was protected to make use of.
So at current there are at present two “Vyper” compilers: The EF-supported work in direction of constructing a compiler written in Rust to ship on the unique concept of Vyper, and the Python effort which can work independently towards the identical objectives within the Python codebase. We’re hopeful that we are able to proceed working collectively in direction of a single “Vyper” with a number of implementations, and we’ll maintain everybody updated because the undertaking strikes ahead.