search

code-423n4 / 2021-09-sushitrident-findings

0 stars 0 forks source link

Unlocked Pragma Statements #142

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

tensors

Vulnerability details

It is widely considered best practice to lock the pragma statements to a specific compiler. See, for example, https://swcregistry.io/docs/SWC-103

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

Proof of concept

https://github.com/sushiswap/trident/blob/7098ef9ad97fa11d350a15d97740e97ad2ca4649/contracts/pool/ConstantProductPool.sol#L3

maxsam4 commented 3 years ago

compiler version is fixed in hardhat config.

alcueca commented 3 years ago

Duplicated with #49