Sigvex
EVMRemediation2 min read

Floating Pragma Remediation

Pin the Solidity compiler version so deployed bytecode matches what was reviewed.

evm

Floating Pragma Remediation

Overview

A floating pragma such as pragma solidity ^0.8.0 lets a contract compile under any compatible compiler version. Different versions optimize code differently, handle edge cases differently, and change default behaviors, so the bytecode that ships may not match the bytecode that was audited. Pinning the version removes that ambiguity.

Related Detector: Floating Pragma

Before (Vulnerable)

// Floating -- any 0.8.x version
pragma solidity ^0.8.0;

After (Fixed)

// Pinned -- exact version
pragma solidity 0.8.20;

A pinned pragma forces every build to use one compiler version. The reviewed source and the deployed bytecode are then guaranteed to come from the same toolchain, eliminating surprises from optimizer changes, EVM target shifts, or new default behaviors introduced in later releases.

Alternative Mitigations

  • Commit the exact compiler version to your build configuration and lockfiles so CI reproduces the deployed artifact byte-for-byte.
  • Record the target EVM version explicitly alongside the pinned pragma, since the default target also changes between releases.
  • Re-audit and re-test before bumping the pinned version rather than letting a caret operator pull in changes silently.

Common Mistakes

  • Pinning the pragma in source but compiling in CI with a different installed compiler, defeating the purpose.
  • Using >=0.8.0 <0.9.0 and treating it as pinned; range operators still float.
  • Bumping the pinned version to fix a build error without re-running the full test suite against the new compiler.

References