Floating pragma
A caret pragma lets the deployed bytecode come from a compiler you never tested.
What it is
pragma solidity ^0.8.0 permits any 0.8.x compiler. The bytecode you audited and the bytecode you deployed can therefore come from different compilers, with different optimiser behaviour and different known bugs.
Why it matters
Reproducing a build becomes guesswork, and a compiler-level bug fixed in one patch version may still be present in whichever version actually compiled your deployment.
The vulnerable pattern
Any 0.8.x compiler satisfies this.
pragma solidity ^0.8.0;The fix, in code
Exactly one compiler.
pragma solidity 0.8.24;How to fix it
- Pin an exact compiler version in the pragma and in your build config.
- Record the version and optimiser settings alongside the audit, and verify the source on the explorer so anyone can check.
How it is detected
Every audit on EVM Smart Audit checks for SWC-103 and reports it as passed or flagged in the standards coverage grid — so the report tells you it was checked even when nothing was found. See the detector suite for what else runs alongside it, or the full database for the other 21 checks.
Check your contract for floating pragma
The engine runs this check and 21 others on every audit, and shows what passed as well as what failed.
Start audit