BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Floating Pragma (^0.8.24) May Introduce Unintended Behavior in Future Compiler Versions.

alikex

Description

The contract needs to be compiled with Solidity 0.8.24, ensuring consistent behavior across deployments and environments.The use of a floating pragma ^0.8.24 allows compilation with any minor version ≥0.8.24. Future compiler versions may introduce optimizations or behavioral changes that could alter contract execution in unpredictable ways. Using a fixed version ensures consistent behavior across environments.

@> pragma solidity ^0.8.24; // Allows any 0.8.x ≥ 0.8.24
contract BriVault is ERC4626, Ownable {
// ... contract code ...
}

Risk

Likelihood:

  • When the contract is recompiled with a newer minor version

  • When different team members use different compiler versions during development

Impact:

  • Unexpected reverts due to compiler changes

  • Could result in unexpected behavior, or security issues in critical functions.

Proof of Concept

Compiling with a future minor version might alter execution unexpectedly. This illustrate the risk of using a floating pragma.

// Compile with 0.8.24
pragma solidity 0.8.24;
contract Recipe {
function mixIngredients() public pure returns (string memory) {
return "Cake";
}
}
​
// PROBLEM: This might work differently in future
pragma solidity ^0.8.24; // The ^ means "any version 0.8.24 or higher"
contract Recipe {
// This might behave differently in future versions
function mixIngredients() public pure returns (string memory) {
return "Cake";
}
}

Recommended Mitigation

By specifying a fixed compiler version the contract always compiles with exactly 0.8.24. This prevents future compiler updates from introducing unexpected changes and ensures consistent execution across deployments and development environments.

- pragma solidity ^0.8.24;
+ pragma solidity 0.8.24;
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!