Solc version used (known-bug versions flagged)
Pendle Finance's assessment for RD-F-170 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Hardhat config primary: solc 0.8.30 + Shanghai EVM. Key router contracts compiled with 0.8.28 (Etherscan confirmed). Market Factory V3: 0.8.23. PENDLE token: 0.7.6 (immutable, no security concern). The TransientStorageClearingHelperCollision bug (solc 0.8.28-0.8.33 + viaIR) requires delete on transient state variables — no transient storage usage found in Pendle V2 contracts, so the bug condition is not met. No other high/critical known bugs apply to 0.8.23-0.8.30 for Pendle's contract patterns.
Sources #
- EtherscanRouter implementation Etherscan (solc 0.8.28+commit.7893614a)ActionAddRemoveLiqV3 — solc 0.8.28 confirmedretrieved 2026-04-29
- Solidity TransientStorageClearingHelperCollision bug (0.8.28-0.8.33, viaIR + transient storage delete)TransientStorageClearingHelperCollision bug detailsretrieved 2026-04-29
- Pendle Core V2 hardhat.config.tsHardhat config — solc 0.8.30, Shanghai, viaIR on overridesretrieved 2026-04-29
Methodology #
Identify the Solidity compiler version used for deployed bytecode and flag if it appears on the known-bug list (solc bugs.json or Vyper 0.2.15–0.3.0 range).
See the full factor methodology and distribution across all protocols →