The core vulnerability manifests in two layers:

1. The CasmContractClass::from_contract_class function (from cairo-lang-starknet-classes) contains integer operations vulnerable to overflow when compiled without overflow-checks=true. This is evidenced by Juno adding 'overflow-checks = true' in their Cargo.toml.
2. The compileSierraToCasm function in Juno's FFI layer directly invoked this vulnerable method with maximum usize values (usize::MAX) and no panic handling pre-patch, as shown by the added panic::catch_unwind in the diff. This function processes raw transaction input, making it the exploitation entry point. Runtime detection would observe both functions in stack traces: the Go/C boundary through compileSierraToCasm, followed by the decompression logic in from_contract_class during attack payload processing.