Token-0x
First Flight #54
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Inconsistent and Floating Pragma Directives Allow Usage of Vulnerable Compiler Versions

zero2audit

Root + Impact

Description

  • Smart contracts should use a specific, locked compiler version (e.g., pragma solidity 0.8.24;) to ensure deterministic bytecode and avoid known bugs present in older or newer compiler versions. All contracts in a system should use the same version.

  • Specific Issue: The codebase uses "floating" pragmas (^) which allow compiling with any future version. Furthermore, there is a significant inconsistency: IERC20.sol allows any version from 0.8.0 upwards, while other files require ^0.8.24. This allows IERC20.sol to be compiled with obsolete and buggy versions (e.g., 0.8.13 which had severe storage corruption bugs).

// In src/IERC20.sol
@> pragma solidity ^0.8.0; // Too wide, allows vulnerable versions
​
// In src/ERC20.sol
@> pragma solidity ^0.8.24; // Floating, not locked

Risk

Likelihood:

  • The deployer uses a default hardhat/foundry configuration that selects an older compiler version (e.g., 0.8.4) for IERC20.sol because the pragma allows it.

  • A future compiler version (e.g., 0.8.26) introduces a breaking change or a new bug, and the contracts are automatically compiled with it because of the ^ symbol.

Impact:

  • Security Vulnerabilities: Compiling IERC20.sol with versions like 0.8.13 or 0.8.14 exposes the contract to known compiler bugs (e.g., "Optimizer Bug Regarding Memory Side Effects") even if the Solidity code itself is correct.

  • Non-Deterministic Builds: The bytecode generated on deployment may differ from the bytecode tested during the audit if the compiler version is not strictly locked.

Proof of Concept

# Output from static analysis
​
INFO:Detectors:
2 different versions of Solidity are used:
- Version constraint ^0.8.24 is used by:
-^0.8.24 (src/ERC20.sol#2)
-^0.8.24 (src/helpers/ERC20Internals.sol#2)
-^0.8.24 (src/helpers/IERC20Errors.sol#2)
- Version constraint ^0.8.0 is used by:
-^0.8.0 (src/IERC20.sol#5)

Recommended Mitigation

// In src/IERC20.sol
- pragma solidity ^0.8.0;
+ pragma solidity 0.8.24;
​
// In src/ERC20.sol
- pragma solidity ^0.8.24;
+ pragma solidity 0.8.24;
​
​
// Apply same change to ERC20Internals.sol and IERC20Errors.sol
Updates

Lead Judging Commences

gaurangbrdv Lead Judge 19 days ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!