Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Since this repo is intended to be a package, you need a floating point pragma #457

Open
PatrickAlphaC opened this issue May 8, 2024 · 0 comments

Comments

@PatrickAlphaC
Copy link

As of today, all the solidity typing using strict versioning, like so:

pragma solidity 0.8.20

While this is perfect for deploying contracts at a specific pragma, what needs to be understood is that a lot of the code in this repo is going to be used as a package as opposed to a stand-alone contract. For example, the zksync docs tell users to install the @matter-labs/zksync package (which, is this repo... sort of) in order to make account abstraction contracts that interact with the system contracts.

Because of this, we need this repo to have a floating pragma, like how openzeppelin or chainlink using floating pragma. Chainlink might be an even better example, because like zksync, they both deploy the contracts and use some as libraries for users.

Now, most auditors will sort of blindly say "oh, you have to use a strict pragma" but this is incorrect in this case because this is meant to be a dependency for smart contract builders building on zksync. If you said:

"Hey, all builders must use only version 0.8.20 of solidity" - then sure, you could do this, but I don't think that is the intention here, and that leads to a very poor developer experience anyways.

So, to summarize:

  1. Figure out which contracts are going to be used as libraries, and give them floating pragmas. You can even call them out in the comments of the file as to why they have floating pragmas
  2. When you send these to audit, tell them they must be floating pragmas because they are libraries, and the security researchers must consider that when working through them. This way, they can consider all the vulnerabilities associated with different versions of solidity.
@PatrickAlphaC PatrickAlphaC changed the title If this repo is intended to be a package, you need a floating point pragma Since this repo is intended to be a package, you need a floating point pragma May 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant