Vyper optimizer bug: msg.value | K compiled to 1

Not applicable (no exploitation reported in the sources).

Root cause: Per the advisory: the optimizer rewrites (or x K) to 1, valid only in a truthiness position, but decides that position from the parent opcode alone, so both value branches of an if are treated as conditions; finalize does not roll it back for callvalue/calldatasize.

Timeline, as sourced: Vyper advisory GHSA-6j9c-gvcw-74fj published 2 Oct 2026; GitHub Advisory Database entry CVE-2026-114117 published 21 Oct 2026.

The Vyper project published advisory GHSA-6j9c-gvcw-74fj (opens in a new tab) on 2 October 2026. With optimization enabled (-O gas, the default, or -O codesize), the expression (msg.value | K), where K is any nonzero integer literal, compiles to the constant 1 when used as a branch of a ternary expression. len(msg.data) | K is affected the same way. Compiling with -O none produces the correct value. The advisory explains that the optimizer rewrites (or x K) to 1, which is only valid where the result is used as a condition, and decides that from the parent opcode alone. The wrong value can reach storage writes, arithmetic, indexes, return values and events; the advisory's example records deposits as 1, locking funds. The advisory lists affected versions as 0.3.8 and later, with no patched version. Severity: Moderate per Vyper advisory (opens in a new tab) / High (CVSS 4.0 score 8.2) per CVE-2026-114117 (opens in a new tab).