fix[lang]: define rounding mode for sqrt

docs/built-in-functions.rst

@@ -711,7 +711,7 @@ Math
 
 .. py:function:: sqrt(d: decimal) -> decimal
 
-    Return the square root of the provided decimal number, using the Babylonian square root algorithm.
+    Return the square root of the provided decimal number, using the Babylonian square root algorithm. The rounding mode is to round down to the nearest epsilon. For instance, ``sqrt(0.9999999998) == 0.9999999998``.
 
     .. code-block:: vyper
 

tests/functional/codegen/types/numbers/test_sqrt.py

@@ -146,6 +146,10 @@ def test_sqrt_bounds(sqrt_contract, value):
 )
 @hypothesis.example(value=Decimal(SizeLimits.MAX_INT128))
 @hypothesis.example(value=Decimal(0))
+# cf. GHSA-2p94-8669-xg86 for the following three examples:
+@hypothesis.example(value=Decimal("0.9999999998"))
+@hypothesis.example(value=Decimal("0.9999999997"))
+@hypothesis.example(value=Decimal("1.1000000000"))
 def test_sqrt_valid_range(sqrt_contract, value):
     vyper_sqrt = sqrt_contract.test(decimal_to_int(value))
     actual_sqrt = decimal_sqrt(value)

vyper/builtins/functions.py

@@ -2145,6 +2145,9 @@ def build_IR(self, expr, args, kwargs, context):
             break
         y = z
         z = (x / z + z) / 2.0
+
+    if y < z:
+        z = y
             """
 
             x_type = DecimalT()