Optimizer Miscompilation in Vyper Releases by Vyperlang

CVE-2026-114117

What is CVE-2026-114117?

Vyper versions up to 0.5.0b1 are affected by an optimizer miscompilation that results in erroneous storage writes and arithmetic operations. Specifically, when using the expressions (msg.value | K) or (len(msg.data) | K) in ternary branches, these conditions may compile incorrectly to the constant 1 under specific optimization settings. This flaw can cause affected smart contracts to mismanage values during storage operations, potentially leading to incorrect deposit records and the unintended locking of funds without notification or transaction reversal.

References