Solidity 0.8.37 Release Announcement

What it is

Solidity v0.8.37, a bugfix release fixing three security-relevant compiler bugs (two rated low/medium, one very low, all reported via the Ethereum Foundation bug bounty) plus two non-security miscompilations. The security summary already names each bug's mechanism and version range; what follows is the triage an engineer needs to decide whether to rebuild and redeploy.

Preconditions / Affected — per bug

The two pipelines matter because they split the exposure cleanly:

• delete on a memory bytes/string-as-bytes element zeros 32 bytes — evmasm (legacy) pipeline only, up to and including 0.8.36. The IR pipeline is not affected, and b[i] = 0 is correct on both. This is the one that corrupts live adjacent memory during normal execution, so it is the highest-priority rebuild if you compile without --via-ir and use delete on memory byte arrays.
• Spill-slot collision under mutual recursion — IR pipeline only (--via-ir), versions 0.7.2–0.8.36. Silently overwrites a live variable. Distinct from, but related to, the "Unsound Spill In Mutual Recursion" bug fixed in 0.8.36 — patching to 0.8.36 did not close this one.
• Misordered named params in require(cond, MyError({...})) — IR pipeline, introduced 0.8.36. Rated very low: it only misencodes revert data of an already-reverting tx. No effect on contract state. revert MyError({...}) and all other named-parameter uses are unaffected. Act on this only if off-chain consumers parse revert payloads.

What to do

Upgrade to 0.8.37. For prioritization, map your build: legacy pipeline + memory-bytes delete → the 32-byte overwrite is a real state-corruption risk. --via-ir + mutually recursive functions → the spill collision can silently corrupt live variables regardless of transaction input.

Caveats

The two non-security miscompilations are downgraded by the vendor for concrete reasons, not just labeling:

• Uninitialized packed function pointers (evmasm): only wrong when compared before ever being assigned; does not affect calls through the pointer, and such comparisons already emit a compiler warning (slated to be disallowed next breaking release). Reliably caught by unit tests.
• Constant reused across checked/unchecked contexts (IR): all operands are compile-time constants, so the wrong result is deterministic and outside attacker influence — it either reverts on first execution or yields a fixed wrapped value, both surfacing in any test with coverage. Requires reading the same overflowing constant from both a checked and an unchecked context in one contract.

Non-security operational notes if you rely on them: --lsp mode and pragma experimental solidity (Generic Solidity) are removed; pragma experimental ABIEncoderV2, and the constantinople/petersburg/istanbul/berlin EVM versions and the SMTChecker BMC engine now emit deprecation warnings. New block.slotnum / Yul slotnum() (EIP-7843) require --evm-version amsterdam.