Solc version used (known-bug versions flagged)
A tooling / compiler / ai factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor records the Solidity compiler version used for the deployed bytecode of the protocol's primary contracts and flags any versions on the known-bug list. The known-bug list covers Solidity versions with documented compiler-level vulnerabilities (e.g., Vyper 0.2.15 through 0.3.0 which had reentrancy guard failures) and end-of-life versions no longer receiving security patches. The version is extracted from bytecode metadata and updated on a slow cadence (semi-annual or on code change).
**Why it matters** Compiler bugs are among the hardest vulnerability classes to detect through standard auditing because auditors review source code while the compiler translates that code into bytecode. A compiler with a known bug can produce incorrect bytecode even from correct source code, creating a gap between the audited behavior and the deployed behavior. The Vyper reentrancy bug (affecting versions 0.2.15 through 0.3.0) is the most documented example in the DeFi ecosystem: it disabled the reentrancy guard macro in those versions, making protocols that relied on the compiler-level guard vulnerable even when their source code appeared correct. Several protocols using these Vyper versions lost funds through reentrancy attacks that should have been prevented by their code.
**Green / Yellow / Red** Green: all deployed contracts use a current, supported Solidity or Vyper version with no known bugs, and the version is consistent across all deployments. Yellow: deployed contracts use a Solidity version that is no longer receiving active patches but has no documented critical bugs; or versions are inconsistent across deployments without a documented reason. Red: any deployed contract uses a Solidity or Vyper version on the known-bug list, particularly any version with a documented reentrancy or arithmetic vulnerability.
**Common gray cases** Protocols with contracts deployed across multiple versions (e.g., older V1 contracts still live alongside newer V2) must be assessed at the version of the contracts currently holding user funds, not the newest version used.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Identify the Solidity compiler version used for deployed bytecode and flag if it appears on the known-bug list (solc bugs.json or Vyper 0.2.15–0.3.0 range).