CVE-2026-114117: Incorrect Calculation in vyperlang vyper

The vulnerability in Vyper 0.3.8 through 0.5.0b1 arises from an optimizer miscompilation under the default -O gas or -O codesize optimization levels. Specifically, expressions of the form (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, when used as a ternary expression branch, are compiled incorrectly to the constant 1. This results in affected contracts using wrong values in critical operations such as storage writes, arithmetic, indexing, return values, or event emissions without any warning or revert. The flaw can cause deposits to be recorded incorrectly and may lock funds within the contract.

Contracts compiled with affected Vyper versions may behave incorrectly due to miscompiled ternary expressions, leading to erroneous storage updates, arithmetic calculations, and event logs. This can cause financial discrepancies such as incorrect deposit records and potentially lock funds, impacting contract reliability and user assets.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, developers should avoid using the affected Vyper versions or the specific ternary expression patterns described. Review and audit contracts compiled with these versions for potential miscompilation issues.