code-423n4 / 2022-10-juicebox-findings

2 stars 0 forks source link

QA Report #183

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

L-1 Unspecified Compiler Version Pragma

Avoid floating pragmas for non-library contracts.

While floating pragmas make sense for libraries to allow them to be included with multiple different versions of applications, it may be a security risk for application implementations.

A known vulnerable compiler version may accidentally be selected or security tools might fall-back to an older compiler version ending up checking a different EVM compilation that is ultimately deployed on the blockchain.

It is recommended to pin to a concrete compiler version.

c4-judge commented 1 year ago

Picodes marked the issue as grade-c