CVE-2026-114117: Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.
Affected Software
Event History
Frequently Asked Questions
Which contracts are affected in practice?
Contracts compiled with Vyper versions 0.3.8 through 0.5.0b1 are affected if they use (msg.value | K) or (len(msg.data) | K), with K a nonzero integer literal, as a ternary-expression branch and were compiled with -O gas or -O codesize. -O gas is the default optimization setting.
Does exploitation require an attacker to have privileges or interact with a user?
No privileges or user interaction are required according to the supplied vector. Exploitation is network-accessible, but has high attack complexity; the vulnerable contract logic must be reachable in a way that makes the miscompiled ternary branch security-relevant.
What is the resulting behavior at runtime?
The affected expression is compiled as the constant 1 rather than its intended value. This can silently cause incorrect storage writes, arithmetic, indexes, return values, or events, without a warning or revert, and may incorrectly record deposits or lock funds.
How can teams determine whether deployed contracts are at risk?
Review the Vyper source and build settings for contracts compiled with affected versions. Look specifically for ternary branches containing (msg.value | K) or (len(msg.data) | K) where K is a nonzero integer literal, and confirm whether -O gas or -O codesize was used.