SWC-103/未锁定的pragma声明
应使用经过全面测试的相同的编译器版本和编译标志得到的合约编译结果进行部署。锁定pragma 有助于避免使用过时的编译器版本意外地部署合约，因为该版本可能会引入会对合约系统产生负面影响的错误。
CWE漏洞分类
整改方案
锁定pragma版本，并考虑所选编译器版本的已知错误。
当合约打算供其他开发人员使用时，可以允许Pragma语句浮动，例如库或EthPM包中的合约。否则，开发人员 将需要手动更新编译pragma声明以便本地编译。
参考文献
合约示例
float_pragma.sol
pragma solidity ^0.4.0;
contract PragmaNotLocked {
uint public x = 1;
}
float_pragma.yaml
description: Floating pragma
issues:
- id: SWC-103
count: 1
locations:
- bytecode_offsets: {}
line_numbers:
floating_pragma.sol: [1]
float_pragma_fixed.sol
pragma solidity 0.4.25;
contract PragmaFixed {
uint public x = 1;
}
float_pragma_fixed.yaml
description: Floating pragma
issues:
- id: SWC-103
count: 0
locations: []
no_pragma.sol
contract PragmaNotLocked {
uint public x = 1;
}
no_pragma.yaml
description: Floating pragma
issues:
- id: SWC-103
count: 1
locations:
- bytecode_offsets: {}
line_numbers:
no_pragma.sol: [1]
semver_floating_pragma.sol
pragma solidity >=0.4.0 < 0.6.0;
pragma solidity >=0.4.0<0.6.0;
pragma solidity >=0.4.14 <0.6.0;
pragma solidity >0.4.13 <0.6.0;
pragma solidity 0.4.24 - 0.5.2;
pragma solidity >=0.4.24 <=0.5.3 ~0.4.20;
pragma solidity <0.4.26;
pragma solidity ~0.4.20;
pragma solidity ^0.4.14;
pragma solidity 0.4.*;
pragma solidity 0.*;
pragma solidity *;
pragma solidity 0.4;
pragma solidity 0;
contract SemVerFloatingPragma {
}
semver_floating_pragma.yaml
description: Floating pragma with semantic versioning operators allows multiple compilers to be used
issues:
- id: SWC-103
count: 14
locations:
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [1]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [2]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [3]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [4]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [5]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [6]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [7]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [8]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [9]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [10]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [11]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [12]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [13]
- bytecode_offsets: {}
line_numbers:
semver_floating_pragma.sol: [14]
semver_floating_pragma_fixed.sol
pragma solidity 0.4.25;
// or
pragma solidity =0.4.25;
contract SemVerFloatingPragmaFixed {
}
semver_floating_pragma_fixed.yaml
description: Floating pragma with semantic versioning operators allows multiple compilers to be used
issues:
- id: SWC-103
count: 0
locations: []