Skip to content

Back to the catalog

Solidity 0.8.36 Release Announcement
soliditylang.orgadvisory

Solidity 0.8.36 Release Announcement

Solidity 0.8.36 release notes disclose two medium-severity compiler bugs: a Yul optimizer call-cycle detection flaw that let stack-to-memory spilling be wrongly applied to mutually recursive functions, causing separate invocations to share and overwrite the same memory slots; and a storage-layout warning bug that could reverse the AST's linearizedBaseContracts annotation when a contract's variables sit very close to the end of storage, corrupting constructor/state-variable initialization order. The release also adds experimental stack-to-memory spilling to the new SSA-form CFG code generator (behind --experimental --via-ssa-cfg) and removes the now-obsolete experimental EOF backend after EOF's rejection from the Fusaka upgrade.

TL;DR Solidity 0.8.36 fixes a memory-corrupting recursion/spilling optimizer bug and a bug that could silently reverse contract inheritance order.
Open original ↗
Document

What it is

Beyond the two medium-severity security fixes the existing summary details, Solidity 0.8.36's changelog carries several additional fixes and features an upgrading engineer should weigh. Both security bugs have named write-ups: Unsound Spill In Mutual Recursion Bug (the Yul optimizer call-cycle flaw) and Inheritance Order Reversal On Storage End Warning Bug (the linearizedBaseContracts reversal in PostTypeContractLevelChecker).

What the summary omits

The storage-end-warning code path had a second, separate defect the summary does not mention: emitting the "too close to end of storage" warning could segfault for contracts that have no storage variables at all. So the same warning feature carried both the annotation-reversal bug and a crash.

Other fixes in this release:

  • Constant Evaluator: ICE when the erc7201 builtin is called with the wrong number of arguments.
  • SMTChecker: incorrect handling of constant operands of unary operations.
  • NatSpec: @return tag is now disallowed in event documentation.
  • Standard JSON: fixes incorrect serialization of optimizer.runs for values in [INT64_MAX, UINT64_MAX].

New capabilities:

  • EVM "Amsterdam" target support is added.
  • --optimize-runs now accepts values in [INT64_MAX, UINT64_MAX] (paired with the Standard JSON serialization fix above).
  • Faster SHA-256 hashing (picosha2).

What to do

Upgrade to 0.8.36 if you use --via-ir (both security bugs affect IR/Yul codegen paths), custom storage layout, or the SMTChecker. Follow the official install docs or download from GitHub (tag v0.8.36). If building from source, do not use GitHub's auto-generated archives — use the solidity_0.8.36.tar.gz tarball or check out the v0.8.36 git tag.

Caveats

The SSA CFG stack-to-memory spilling remains experimental behind --experimental --via-ssa-cfg and is not the default for --via-ir; the team names stabilizing it as a six-month priority, so do not depend on it for production yet. The page gives no affected-version ranges for either security bug, so scope of prior exposure isn't stated.

Organisations named here

  • Inheritance Order Reversal On Storage End Warning Bug

Technologies named here

  • Solidity compiler
  • Yul optimizer
  • SSA CFG code generator
  • SMTChecker
  • Standard JSON Interface
  • Solidity

Techniques named here

  • Unsound stack-to-memory spilling in recursive functions
  • Unsound Spill In Mutual Recursion Bug

Related in Blockchain