<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
    <channel>
        <title>Solidity Lang Blog - Security Alerts</title>
        <link>https://soliditylang.org/</link>
        <description></description>
        <lastBuildDate>Tue, 21 Jul 2026 13:32:22 GMT</lastBuildDate>
        <docs>https://validator.w3.org/feed/docs/rss2.html</docs>
        <generator>https://github.com/jpmonette/feed</generator>
        <image>
            <title>Solidity Lang Blog - Security Alerts</title>
            <url>https://soliditylang.org//assets/solidity-logo.svg</url>
            <link>https://soliditylang.org/</link>
        </image>
        <copyright>All rights reserved 2026</copyright>
        <item>
            <title><![CDATA[Unsound Spill In Mutual Recursion Bug]]></title>
            <link>https://soliditylang.org///blog/2026/07/09/unsound-spill-in-mutual-recursion-bug</link>
            <guid>https://soliditylang.org///blog/2026/07/09/unsound-spill-in-mutual-recursion-bug</guid>
            <pubDate>Thu, 09 Jul 2026 00:00:00 GMT</pubDate>
            <description><![CDATA[On May 11, 2026, clonker from the Solidity team discovered a bug in the Yul optimizer's call graph analysis. The bug resulted in mutually recursive functions being sometimes misclassified as non-recursive, and therefore not being excluded from the memory spilling mechanism that is incompatible with recursive functions. The mechanism relocates...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Inheritance Order Reversal On Storage End Warning Bug]]></title>
            <link>https://soliditylang.org///blog/2026/07/09/inheritance-order-reversal-on-storage-end-warning-bug</link>
            <guid>https://soliditylang.org///blog/2026/07/09/inheritance-order-reversal-on-storage-end-warning-bug</guid>
            <pubDate>Thu, 09 Jul 2026 00:00:00 GMT</pubDate>
            <description><![CDATA[On June 8, 2026, clonker from the Solidity team discovered a bug in the analysis phase of the Solidity compiler. The bug manifests when the compiler emits Warning 3495 about a custom storage layout being placed too close to the end of storage. The implementation of said warning reverses the...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Misordered Named Parameters in require with Custom Errors Bug]]></title>
            <link>https://soliditylang.org///blog/2026/05/20/misordered-named-parameters-in-require-with-custom-errors-bug</link>
            <guid>https://soliditylang.org///blog/2026/05/20/misordered-named-parameters-in-require-with-custom-errors-bug</guid>
            <pubDate>Wed, 20 May 2026 00:00:00 GMT</pubDate>
            <description><![CDATA[On February 9, 2026, a bug in the IR-based code generator was reported through the Ethereum Foundation bug bounty program. The bug causes the arguments of a custom error passed to require using named-parameter syntax to be ABI-encoded in call-site order rather than declaration order.  The bug was introduced...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Transient Storage Clearing Helper Collision Bug]]></title>
            <link>https://soliditylang.org///blog/2026/02/18/transient-storage-clearing-helper-collision-bug</link>
            <guid>https://soliditylang.org///blog/2026/02/18/transient-storage-clearing-helper-collision-bug</guid>
            <pubDate>Wed, 18 Feb 2026 00:00:00 GMT</pubDate>
            <description><![CDATA[On 2026-02-11, a bug in the Solidity code generator was reported by Hexens. The bug affects compiler versions 0.8.28 through 0.8.33 when using the IR pipeline. When a contract clears both a persistent and a transient storage variable of the same type, the compiler will emit the wrong opcode (sstore...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Lost Storage Array Write on Slot Overflow Bug]]></title>
            <link>https://soliditylang.org///blog/2025/12/18/lost-storage-array-write-on-slot-overflow-bug</link>
            <guid>https://soliditylang.org///blog/2025/12/18/lost-storage-array-write-on-slot-overflow-bug</guid>
            <pubDate>Thu, 18 Dec 2025 00:00:00 GMT</pubDate>
            <description><![CDATA[On November 10, 2024, a bug in the Solidity code generator was found by @Audittens. The bug was initially reported to affect deletion and partial assignment operations on fixed-length storage arrays that cross the 2**256-slot boundary. Two instances were reported: one in the IR pipeline and one in the evmasm...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Bug in Deduplication of Verbatim Blocks]]></title>
            <link>https://soliditylang.org///blog/2023/11/08/verbatim-invalid-deduplication-bug</link>
            <guid>https://soliditylang.org///blog/2023/11/08/verbatim-invalid-deduplication-bug</guid>
            <pubDate>Wed, 08 Nov 2023 00:00:00 GMT</pubDate>
            <description><![CDATA[On October 24, Ori Pomerantz reported a bug affecting the use of verbatim builtin in Yul code. After investigating, the team was able to confirm the problem and locate its origin. The bug existed in the Block Deduplicator optimizer step, wherein equivalent assembly blocks are identified and merged. verbatim assembly...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Bug in Legacy Code Generation When Accessing the .selector Member on Expressions with Side Effects]]></title>
            <link>https://soliditylang.org///blog/2023/07/19/missing-side-effects-on-selector-access-bug</link>
            <guid>https://soliditylang.org///blog/2023/07/19/missing-side-effects-on-selector-access-bug</guid>
            <pubDate>Wed, 19 Jul 2023 00:00:00 GMT</pubDate>
            <description><![CDATA[On June 26, 2023, a bug in the legacy code generation pipeline of the Solidity compiler was found during investigation of a security report related to the use of abi.decode with a ternary expression that has side effects, as the type argument.  The legacy code generator was not evaluating...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[FullInliner Non-Expression-Split Argument Evaluation Order Bug]]></title>
            <link>https://soliditylang.org///blog/2023/07/19/full-inliner-non-expression-split-argument-evaluation-order-bug</link>
            <guid>https://soliditylang.org///blog/2023/07/19/full-inliner-non-expression-split-argument-evaluation-order-bug</guid>
            <pubDate>Wed, 19 Jul 2023 00:00:00 GMT</pubDate>
            <description><![CDATA[On July 4, 2023, Robert Chen from OtterSec discovered a bug in the Yul optimizer.  The earliest affected version of the compiler is 0.6.7, which introduced the ability to modify the optimizer step sequence. Solidity version 0.8.21, released on July 19, 2023, provides a fix.  We assigned the...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Storage Write Removal Bug On Conditional Early Termination]]></title>
            <link>https://soliditylang.org///blog/2022/09/08/storage-write-removal-before-conditional-termination</link>
            <guid>https://soliditylang.org///blog/2022/09/08/storage-write-removal-before-conditional-termination</guid>
            <pubDate>Thu, 08 Sep 2022 00:00:00 GMT</pubDate>
            <description><![CDATA[On September 5, 2022, a bug in Solidity's Yul optimizer was found by differential fuzzing.  The bug was introduced in version 0.8.13 and Solidity version 0.8.17, released on September 08, 2022, provides a fix. The bug is significantly easier to trigger with optimized via-IR code generation, but can theoretically...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Head Overflow Bug in Calldata Tuple ABI-Reencoding]]></title>
            <link>https://soliditylang.org///blog/2022/08/08/calldata-tuple-reencoding-head-overflow-bug</link>
            <guid>https://soliditylang.org///blog/2022/08/08/calldata-tuple-reencoding-head-overflow-bug</guid>
            <pubDate>Mon, 08 Aug 2022 00:00:00 GMT</pubDate>
            <description><![CDATA[On July 5, 2022, Chance Hudson (@vimwitch) from the Ethereum Foundation discovered a bug in the Solidity code generator.  The earliest affected version of the compiler is 0.5.8, which introduced ABI-reencoding of calldata arrays and structs. Solidity version 0.8.16, released on August 08, 2022, provides a fix.  We...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Optimizer Bug Regarding Memory Side Effects of Inline Assembly]]></title>
            <link>https://soliditylang.org///blog/2022/06/15/inline-assembly-memory-side-effects-bug</link>
            <guid>https://soliditylang.org///blog/2022/06/15/inline-assembly-memory-side-effects-bug</guid>
            <pubDate>Wed, 15 Jun 2022 00:00:00 GMT</pubDate>
            <description><![CDATA[On June 5, 2022, John Toman of the Certora development team reported an optimizer bug that can cause memory writes in inline assembly blocks to be incorrectly removed under certain conditions.  The bug was introduced in Solidity 0.8.13 with a new Yul optimizer step meant to remove unused writes...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Bug when Copying Dirty Bytes Arrays to Storage]]></title>
            <link>https://soliditylang.org///blog/2022/06/15/dirty-bytes-array-to-storage-bug</link>
            <guid>https://soliditylang.org///blog/2022/06/15/dirty-bytes-array-to-storage-bug</guid>
            <pubDate>Wed, 15 Jun 2022 00:00:00 GMT</pubDate>
            <description><![CDATA[On July 1, 2021, a bug in the Solidity code generator was found by differential fuzzing. The bug causes the legacy code generation pipeline to generate code that may write dirty values to storage when copying bytes arrays from calldata or memory.  Initially, it was assumed that the dirty...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Bug Concerning Data Location during Inheritance]]></title>
            <link>https://soliditylang.org///blog/2022/05/17/data-location-inheritance-bug</link>
            <guid>https://soliditylang.org///blog/2022/05/17/data-location-inheritance-bug</guid>
            <pubDate>Tue, 17 May 2022 00:00:00 GMT</pubDate>
            <description><![CDATA[On February 5th 2021, Nicolas Venturo reported a bug that allows overriding functions to change the data location of parameters from memory to calldata.  The bug was introduced in Solidity 0.6.9 together with the ability to use calldata data location for all variables (and not just parameters of external...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Size Check Bug in Nested Calldata Array ABI-Reencoding]]></title>
            <link>https://soliditylang.org///blog/2022/05/17/calldata-reencode-size-check-bug</link>
            <guid>https://soliditylang.org///blog/2022/05/17/calldata-reencode-size-check-bug</guid>
            <pubDate>Tue, 17 May 2022 00:00:00 GMT</pubDate>
            <description><![CDATA[On April 7, 2022, a bug in the Solidity code generator was reported by John Toman of the Certora development team. Certora's bug disclosure post can be found here.  The bug is fixed with Solidity version 0.8.14 released on May 17, 2022. The bug was first introduced in Solidity...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[abi.encodeCall Literals Bug]]></title>
            <link>https://soliditylang.org///blog/2022/03/16/encodecall-bug</link>
            <guid>https://soliditylang.org///blog/2022/03/16/encodecall-bug</guid>
            <pubDate>Wed, 16 Mar 2022 00:00:00 GMT</pubDate>
            <description><![CDATA[On March 10th, 2022, the Solidity team discovered a bug in the implementation of abi.encodeCall when used together with fixed-length bytes literals.  It was introduced together with abi.encodeCall in Solidity 0.8.11 and is fixed in 0.8.13.  We assigned the bug a severity of "very low".  Which Contracts...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[User Defined Value Types Bug]]></title>
            <link>https://soliditylang.org///blog/2021/09/29/user-defined-value-types-bug</link>
            <guid>https://soliditylang.org///blog/2021/09/29/user-defined-value-types-bug</guid>
            <pubDate>Wed, 29 Sep 2021 00:00:00 GMT</pubDate>
            <description><![CDATA[On September 28th, 2021, Harry Altman (@haltman-at) of Truffle discovered a bug in user defined value types.  The bug has no influence on the correctness of Solidity contracts, but contracts compiled with Solidity 0.8.8 that use the new feature are unnecessarily wasteful and might have problems with tooling or...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Signed Immutables Bug]]></title>
            <link>https://soliditylang.org///blog/2021/09/29/signed-immutables-bug</link>
            <guid>https://soliditylang.org///blog/2021/09/29/signed-immutables-bug</guid>
            <pubDate>Wed, 29 Sep 2021 00:00:00 GMT</pubDate>
            <description><![CDATA[On September 28th, 2021, the Solidity team discovered that for immutable variables of a signed integer type shorter than 256 bits, sign extension (cleanup) of its value is not always properly performed.  To our knowledge, the value can only be accessed in its unclean state when using inline assembly....]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity ABI Decoder Bug For Multi-Dimensional Memory Arrays]]></title>
            <link>https://soliditylang.org///blog/2021/04/21/decoding-from-memory-bug</link>
            <guid>https://soliditylang.org///blog/2021/04/21/decoding-from-memory-bug</guid>
            <pubDate>Wed, 21 Apr 2021 00:00:00 GMT</pubDate>
            <description><![CDATA[On April 5th, 2021, a bug in the Solidity ABI decoder v2 was reported by John Toman of the Certora development team. Certora's bug disclosure post can be found here: Memory Isolation Violation in Deserialization Code.  The bug is fixed with Solidity version 0.8.4 released on April 21st, 2021....]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity Optimizer Keccak Caching Bug]]></title>
            <link>https://soliditylang.org///blog/2021/03/23/keccak-optimizer-bug</link>
            <guid>https://soliditylang.org///blog/2021/03/23/keccak-optimizer-bug</guid>
            <pubDate>Tue, 23 Mar 2021 00:00:00 GMT</pubDate>
            <description><![CDATA[On March 20, 2021, a bug in Solidity's bytecode optimizer was found by differential fuzzing. The bug is fixed with version 0.8.3 released on March 23, 2021. The bug is present in all prior versions of Solidity.  We assigned the bug a severity level of "medium".  Technical Details...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity Empty Byte Array Copy Bug]]></title>
            <link>https://soliditylang.org///blog/2020/10/19/empty-byte-array-copy-bug</link>
            <guid>https://soliditylang.org///blog/2020/10/19/empty-byte-array-copy-bug</guid>
            <pubDate>Mon, 19 Oct 2020 00:00:00 GMT</pubDate>
            <description><![CDATA[On October 14, 2020, a bug in the Solidity code generator was reported by John Toman of the Certora development team. Certora's bug disclosure post can be found here.  The bug is fixed with Solidity version 0.7.4 released on October 19, 2020. The bug is present in all prior...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity Dynamic Array Cleanup Bug]]></title>
            <link>https://soliditylang.org///blog/2020/10/07/solidity-dynamic-array-cleanup-bug</link>
            <guid>https://soliditylang.org///blog/2020/10/07/solidity-dynamic-array-cleanup-bug</guid>
            <pubDate>Wed, 07 Oct 2020 00:00:00 GMT</pubDate>
            <description><![CDATA[On September 17, 2020, a bug in the Solidity code generator was found. The bug is fixed with version 0.7.3 released on October 7, 2020. The bug is present in all prior versions of Solidity.  We assigned the bug a severity level of "medium".  Technical Details of the...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity Memory Array Creation Overflow Bug]]></title>
            <link>https://soliditylang.org///blog/2020/04/06/memory-creation-overflow-bug</link>
            <guid>https://soliditylang.org///blog/2020/04/06/memory-creation-overflow-bug</guid>
            <pubDate>Mon, 06 Apr 2020 00:00:00 GMT</pubDate>
            <description><![CDATA[On the 28th of March, a bug in the Solidity code generator was reported through the Ethereum Foundation Bounty program, by John Toman of Certora. The bug is fixed with version 0.6.5, released on 2020-04-06. The bug is present in all prior versions of Solidity.  We assigned a severity...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity Storage Array Bugs]]></title>
            <link>https://soliditylang.org///blog/2019/06/25/solidity-storage-array-bugs</link>
            <guid>https://soliditylang.org///blog/2019/06/25/solidity-storage-array-bugs</guid>
            <pubDate>Tue, 25 Jun 2019 00:00:00 GMT</pubDate>
            <description><![CDATA[This post was originally published on the Ethereum blog.  This blog post is about two bugs connected to storage arrays which are otherwise unrelated. Both have been present in the compiler for a long time and have only been discovered now even though a contract containing them should very...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity Optimizer and ABIEncoderV2 Bugs]]></title>
            <link>https://soliditylang.org///blog/2019/03/26/solidity-optimizer-and-abiencoderv2-bug</link>
            <guid>https://soliditylang.org///blog/2019/03/26/solidity-optimizer-and-abiencoderv2-bug</guid>
            <pubDate>Tue, 26 Mar 2019 00:00:00 GMT</pubDate>
            <description><![CDATA[This post was originally published on the Ethereum blog.  Through the Ethereum bug bounty program, we received a report about a flaw within the new experimental ABI encoder (referred to as ABIEncoderV2). Upon investigation, it was found that the component suffers from a few different variations of the same...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity Bugfix Release]]></title>
            <link>https://soliditylang.org///blog/2018/09/13/solidity-bugfix-release</link>
            <guid>https://soliditylang.org///blog/2018/09/13/solidity-bugfix-release</guid>
            <pubDate>Thu, 13 Sep 2018 00:00:00 GMT</pubDate>
            <description><![CDATA[This post was originally published on the Ethereum blog.  The latest version 0.4.25 release of Solidity fixes two important bugs. Another important bug has already been fixed in version 0.4.22 but it was only discovered recently that the bug existed.  Note that the Ethereum Foundation runs a bounty...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Solidity Optimizer Bug]]></title>
            <link>https://soliditylang.org///blog/2017/05/03/solidity-optimizer-bug</link>
            <guid>https://soliditylang.org///blog/2017/05/03/solidity-optimizer-bug</guid>
            <pubDate>Wed, 03 May 2017 00:00:00 GMT</pubDate>
            <description><![CDATA[This post was originally published on the Ethereum blog.  A bug in the Solidity optimizer was reported through the Ethereum Foundation Bounty program, by Christoph Jentzsch. This bug is patched as of 2017-05-03, with the release of Solidity 0.4.11.  Background  The bug in question concerned how the...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Analysis of Storage Corruption Bug]]></title>
            <link>https://soliditylang.org///blog/2016/11/09/analysis-storage-corruption-bug</link>
            <guid>https://soliditylang.org///blog/2016/11/09/analysis-storage-corruption-bug</guid>
            <pubDate>Wed, 09 Nov 2016 00:00:00 GMT</pubDate>
            <description><![CDATA[This post was originally published on the Ethereum blog.  This blog post provides an update on our findings following the discovery of the storage corruption bug last week. In summary, the bug was much less severe than we initially thought. The small number of affected contracts we found is...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Security Alert: Variables can be overwritten in storage]]></title>
            <link>https://soliditylang.org///blog/2016/11/01/security-alert-solidity-variables-can-overwritten-storage</link>
            <guid>https://soliditylang.org///blog/2016/11/01/security-alert-solidity-variables-can-overwritten-storage</guid>
            <pubDate>Tue, 01 Nov 2016 00:00:00 GMT</pubDate>
            <description><![CDATA[This post was originally published on the Ethereum blog.  Summary: In some situations, variables can overwrite other variables in storage.  *Affected Solidity compiler versions: *0.1.6 to 0.4.3 (including 0.4.4 pre-release versions)  Detailed description:  Storage variables that are smaller than 256 bits are packed together into the...]]></description>
            <category>Security Alerts</category>
        </item>
        <item>
            <title><![CDATA[Smart Contract Security]]></title>
            <link>https://soliditylang.org///blog/2016/06/10/smart-contract-security</link>
            <guid>https://soliditylang.org///blog/2016/06/10/smart-contract-security</guid>
            <pubDate>Fri, 10 Jun 2016 00:00:00 GMT</pubDate>
            <description><![CDATA[This post was originally published on the Ethereum blog.  Solidity was started in October 2014 when neither the Ethereum network nor the virtual machine had any real-world testing, the gas costs at that time were even drastically different from what they are now. Furthermore, some of the early design...]]></description>
            <category>Security Alerts</category>
        </item>
    </channel>
</rss>