Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Floating Pragma is set. #19

Open
code423n4 opened this issue Dec 1, 2021 · 1 comment
Open

Floating Pragma is set. #19

code423n4 opened this issue Dec 1, 2021 · 1 comment
Labels
1 (Low Risk) Assets are not at risk. State handling, function incorrect as to spec, issues with comments bug Something isn't working

Comments

@code423n4
Copy link
Contributor

Handle

cyberboy

Vulnerability details

Note: Please ignore my last submission. It was an error

Impact

Contracts should be deployed using the same compiler version/flags with which they have been tested. Locking the pragma (for e.g. by not using ^ in pragma solidity 0.5.10) ensures that contracts do not accidentally get deployed using an older compiler version with unfixed bugs

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/main/Streaming/src/Locke.sol
Is using
pragma solidity ^0.8.0;

Also, the imports are using floating pragmas

Tools Used

Recommended Mitigation Steps

The correct will be
pragma solidity 0.8.0;

And should be made across all the imports.

@code423n4 code423n4 added 0 (Non-critical) Code style, clarity, syntax, versioning, off-chain monitoring (events etc), exclude gas optimisation bug Something isn't working labels Dec 1, 2021
code423n4 added a commit that referenced this issue Dec 1, 2021
@0xean 0xean added 1 (Low Risk) Assets are not at risk. State handling, function incorrect as to spec, issues with comments and removed 0 (Non-critical) Code style, clarity, syntax, versioning, off-chain monitoring (events etc), exclude gas optimisation labels Jan 16, 2022
@0xean
Copy link
Collaborator

0xean commented Jan 16, 2022

upgrading to low-risk for this and all the duplicates as this is a best practice for all deployments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
1 (Low Risk) Assets are not at risk. State handling, function incorrect as to spec, issues with comments bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants