Vyper 0.3.8 through 0.5.0b1 compiles expressions that combine msg.value or len(msg.data) with a non‑zero integer literal inside a ternary operator to the constant 1 when the gas or codesize optimizer is enabled. The incorrect value is used in storage writes, arithmetic, indexes, return values, or events, allowing funds to be recorded incorrectly, leading to locked or misallocated balances without any error or revert.

This flaw impacts the Vyper compiler and any smart contracts compiled with Vyper versions 0.3.8 through 0.5.0b1. These contracts are typically deployed on the Ethereum network and use the default optimizer flags –O gas or -O codesize, common in production deployments.

The CVSS score of 8.2 denotes high severity, but the EPSS score of less than 1% and the absence from the KEV catalog imply a low current exploitation probability. The likely attack vector is a crafted transaction that invokes a vulnerable function containing a ternary expression with msg.value or len(msg.data); this inference is based on the description. If exploited, the miscompiled value of 1 will corrupt stored balances, return values or event logs, potentially locking funds or creating accounting errors. Because the flaw requires a specific ternary pattern, the attack surface is narrow but the potential loss for affected contracts is substantial.