CVE-2026-114117 PUBLISHED

Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches

Assigner: VulnCheck
Reserved: 20.10.2026 Published: 21.10.2026 Updated: 21.10.2026

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.2

Product Status

Vendor vyperlang
Product vyper
Versions Default: unaffected
  • affected from 0.3.8 to 0.5.0b1 (incl.)

Credits

  • DELENE-TCHIO-ROMUALD finder

References

Problem Types

  • Incorrect Calculation CWE