use of floating pragma

[code423n4]

Handle

JMukesh

Vulnerability details

Impact

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

Proof of Concept

https://github.com/code-423n4/2021-11-bootfinance/blob/b4ebd0a5ebcbc24f3d15836cdb9759243fc85868/core-contracts/contracts/sol/BTCPoolDelegator.sol#L3

https://github.com/code-423n4/2021-11-bootfinance/blob/b4ebd0a5ebcbc24f3d15836cdb9759243fc85868/core-contracts/contracts/sol/ETHPoolDelegator.sol#L3

https://github.com/code-423n4/2021-11-bootfinance/blob/b4ebd0a5ebcbc24f3d15836cdb9759243fc85868/core-contracts/contracts/sol/USDPoolDelegator.sol#L3

Tools Used

manual review

Recommended Mitigation Steps

use fixed solidity version

[chickenpie347]

Duplicate of #29

[0xean]

Slightly different recommendation to not use a floating pragma regardless of the upgrade to 0.8.4+

[0xean]

(IE not a dupe)