Vyper CVE-2026-114117

Exploitation requires a contract compiled with Vyper 0.3.8 through 0.5.0b1 whose source contains the specific pattern (msg.value | K) or (len(msg.data) | K) - where K is a nonzero integer literal - used as a branch of a ternary expression, and compiled under -O gas (the default) or -O codesize. When present, the optimizer miscompiles that expression to the constant 1 with no warning or revert, corrupting storage writes, arithmetic, indexes, return values, or events. Limiting factors: the vulnerable code construct must already exist in the deployed contract (reflected as AT:P in the CVSS 4.0 vector); contracts not using this exact OR-in-ternary pattern, or compiled with other optimizer settings/fixed compiler versions, are unaffected. No authentication is required (PR:N) because any caller submitting a normal transaction triggers the already-miscompiled code path.

This is a compiler-correctness defect (CWE-682) in the Vyper optimizer, not a runtime memory-safety flaw, so its real-world risk is highly conditional. The supplied CVSS 4.0 vector (8.2) shows AV:N/PR:N/UI:N but critically carries AT:P (attack requirements present) and an integrity-only impact (VC:N/VI:H/VA:N) - meaning exploitation is reachable over the network by any unauthenticated caller ONLY if a deployed contract happens to contain the exact miscompiled code pattern. No EPSS score, no CISA KEV listing, and no public exploit were provided, which is consistent with a class of bug that is latent in already-deployed bytecode rather than actively weaponized across the internet. The 8.2 is driven by VI:H (silent incorrect values with no revert) applied to high-value financial contracts, but the AT:P requirement and the need for the specific (msg.value | K)/(len(msg.data) | K)-in-a-ternary pattern mean this is a targeted, contract-specific exposure rather than a broad spray-and-pray vulnerability. Note a data conflict: the input Tag 'Information Disclosure' contradicts the CVSS vector, which records VC:N (no confidentiality impact) - this is an integrity/miscompilation issue, not disclosure, and the tag should not be used to prioritize. Prioritize auditing and recompiling affected contracts, but do not treat this as an imminent mass-exploitation event absent EPSS/KEV signals.

A DeFi contract compiled with Vyper 0.3.8-0.5.0b1 under the default -O gas setting uses (msg.value | K) inside a ternary branch to compute a deposit amount; the optimizer silently replaces that expression with the constant 1. An attacker (or ordinary user) sends a transaction whose deposit is recorded as 1 wei regardless of actual value sent, corrupting storage accounting so that funds become mis-credited or permanently locked. No public exploit was identified at time of analysis, and because the flaw carries AT:P the impact only occurs for contracts that actually contain the vulnerable pattern.