Skip to content
low Best Practice SWC-103 CWE-664

Floating / Unlocked Pragma

SAFE-0078 Best Practice Checked automatically by the scanner
1

What goes wrong

A floating pragma (e.g. ^0.8.0) lets the contract compile with compiler versions not tested against, risking compiler-specific bugs or behavioral differences in deployment.

2

How to fix it

the pattern that is safe
pragma solidity 0.8.24; // locked
◆
SWC-103. Lock the compiler version.
3

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$69.3M · 2023 Curve Finance · Vyper compiler Compiler / toolchain + Reentrancy · 2023
4

Related vulnerabilities in Best Practice

SAFE-0076Use of Deprecated / Dangerous Constructs (selfdestruct, suicide, throw) medium · Best Practice SAFE-0079Outdated Compiler / Known Compiler Bug Exposure medium · Best Practice SAFE-0083Emergency Pause Missing / Pause Bypass medium · Best Practice SAFE-0075Missing Event Emission on Critical Action low · Best Practice SAFE-0077Dead Code / Unreachable or Unused Critical Variable low · Best Practice SAFE-0097Assert/Require Misuse and Improper Error Handling low · Best Practice SAFE-0138Floating / Unlocked Pragma low · Best Practice SAFE-0139Deprecated / Unsafe Language Constructs low · Best Practice
← PreviousDead Code / Unreachable or Unused Critical Variable
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0078 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs