GivingThanks

Summary

GivingThanks is using floating pragma which introduces a range of security, compatibility, and maintenance risks. While it is commonly used for flexibility and ease during initial development, it is generally not recommended for production code.

Vulnerability Details

Contracts should be deployed with the same compiler version and flags used during development and testing. Locking the pragma helps to ensure that contracts do not accidentally get deployed using another pragma. For example, an outdated pragma version might introduce bugs that affect the contract system negatively or recently released pragma versions may have unknown security vulnerabilities.

Impact

• Reduced trust: It’s harder to verify that the deployed contract is the same one that was audited, especially if it is compiled with a newer version than the one used during the audit.

• Loss of security guarantees: Changes in compiler behavior could negate the conclusions of a security audit, making your contracts less reliable.

Tools Used

manual

Recommendations

Consider locking the pragma