Return to Question

I've seen this question pop-up a bunch of times: "is version 0.x.x safe to use in production?" Therefore, I'm wondering if there is a clear way to tell which versions are recommended for production (Mainnet) and which are not. For example, running the latest version of Slither suggests the following: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity

When this question was asked on the official solidity gitter, the following answer was provided by one of the members of the Solidity dev team:

Generally, you should always only use the latest released version available, no prior version whatsoever. [...] We keep a list of security relevant bugs known to be present in each compiler version in https://github.com/ethereum/solidity/blob/develop/docs/bugs_by_version.json. Generally, fixes are not backported across breaking releases (i.e. once 0.8.0 is released, 0.7.x won't be updated anymore). So you always want to use the most recent breaking release series. In the most recent breaking release series there will be backwards-compatible minor releases that may introduce non-breaking features and fix bugs - again it's always best to use the most recent one. So unless you have a compelling reason not to use it, the most recent released version should always be preferred and if any tooling does not yet support it, I'd suggest to pressure them to update. In case you really have to use an older release, be sure to at least check the relevant entries to the bug list.

However, we've seen time and time again that security researchers do find bugs in the most recent versions of solidity. Therefore, it is not clear how to determine the best trade-off between using recent solidity language features and also being fairly confident that enough security researchers have poked the compiler corresponding to that version of solidity and there's not many other things that can be found.

UPDATE: It seems that most of the bugs found in recent versions of Solidity have a tendency to affect all prior versions of Solidity. This supports the argument for using the latest version of Solidity.

I've seen this question pop-up a bunch of times: "is version 0.x.x safe to use in production?" Therefore, I'm wondering if there is a clear way to tell which versions are recommended for production (Mainnet) and which are not. For example, running the latest version of Slither suggests the following: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity

When this question was asked on the official solidity gitter, the following answer was provided by one of the members of the Solidity dev team:

Generally, you should always only use the latest released version available, no prior version whatsoever. [...] We keep a list of security relevant bugs known to be present in each compiler version in https://github.com/ethereum/solidity/blob/develop/docs/bugs_by_version.json. Generally, fixes are not backported across breaking releases (i.e. once 0.8.0 is released, 0.7.x won't be updated anymore). So you always want to use the most recent breaking release series. In the most recent breaking release series there will be backwards-compatible minor releases that may introduce non-breaking features and fix bugs - again it's always best to use the most recent one. So unless you have a compelling reason not to use it, the most recent released version should always be preferred and if any tooling does not yet support it, I'd suggest to pressure them to update. In case you really have to use an older release, be sure to at least check the relevant entries to the bug list.

However, we've seen time and time again that security researchers do find bugs in the most recent versions of solidity. Therefore, it is not clear how to determine the best trade-off between using recent solidity language features and also being fairly confident that enough security researchers have poked the compiler corresponding to that version of solidity and there's not many other things that can be found.

UPDATE: It seems that most of the bugs found in recent versions of Solidity have a tendency to affect all prior versions of Solidity. This supports the argument for using the latest version of Solidity.

I've seen this question pop-up a bunch of times: "is version 0.x.x safe to use in production?" Therefore, I'm wondering if there is a clear way to tell which versions are recommended for production (Mainnet) and which are not. For example, running the latest version of Slither suggests using 0.6.11 https://github.com/crytic/slither/blob/081a0717efbf983c567602d982a09780f7d74920/slither/detectors/attributes/incorrect_solc.py#L50

When this question was asked on the official solidity gitter, the following answer was provided by one of the members of the Solidity dev team:

Generally, you should always only use the latest released version available, no prior version whatsoever. [...] We keep a list of security relevant bugs known to be present in each compiler version in https://github.com/ethereum/solidity/blob/develop/docs/bugs_by_version.json. Generally, fixes are not backported across breaking releases (i.e. once 0.8.0 is released, 0.7.x won't be updated anymore). So you always want to use the most recent breaking release series. In the most recent breaking release series there will be backwards-compatible minor releases that may introduce non-breaking features and fix bugs - again it's always best to use the most recent one. So unless you have a compelling reason not to use it, the most recent released version should always be preferred and if any tooling does not yet support it, I'd suggest to pressure them to update. In case you really have to use an older release, be sure to at least check the relevant entries to the bug list.

However, we've seen time and time again that security researchers do find bugs in the most recent versions of solidity. Therefore, it is not clear how to determine the best trade-off between using recent solidity language features and also being fairly confident that enough security researchers have poked the compiler corresponding to that version of solidity and there's not many other things that can be found.

I've seen this question pop-up a bunch of times: "is version 0.x.x safe to use in production?" Therefore, I'm wondering if there is a clear way to tell which versions are recommended for production (Mainnet) and which are not. For example, running the latest version of Slither suggests the following: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity

When this question was asked on the official solidity gitter, the following answer was provided by one of the members of the Solidity dev team:

Generally, you should always only use the latest released version available, no prior version whatsoever. [...] We keep a list of security relevant bugs known to be present in each compiler version in https://github.com/ethereum/solidity/blob/develop/docs/bugs_by_version.json. Generally, fixes are not backported across breaking releases (i.e. once 0.8.0 is released, 0.7.x won't be updated anymore). So you always want to use the most recent breaking release series. In the most recent breaking release series there will be backwards-compatible minor releases that may introduce non-breaking features and fix bugs - again it's always best to use the most recent one. So unless you have a compelling reason not to use it, the most recent released version should always be preferred and if any tooling does not yet support it, I'd suggest to pressure them to update. In case you really have to use an older release, be sure to at least check the relevant entries to the bug list.

However, we've seen time and time again that security researchers do find bugs in the most recent versions of solidity. Therefore, it is not clear how to determine the best trade-off between using recent solidity language features and also being fairly confident that enough security researchers have poked the compiler corresponding to that version of solidity and there's not many other things that can be found.

UPDATE: It seems that most of the bugs found in recent versions of Solidity have a tendency to affect all prior versions of Solidity. This supports the argument for using the latest version of Solidity.

I've seen this question pop-up a bunch of times: "is version 0.x.x safe to use in production?" Therefore, I'm wondering if there is a clear way to tell which versions are recommended for production (Mainnet) and which are not. For example, running the latest version of Slither suggests using 0.6.11 https://github.com/crytic/slither/blob/081a0717efbf983c567602d982a09780f7d74920/slither/detectors/attributes/incorrect_solc.py#L50

When this question was asked on the official solidity gitter, the following answer was provided by one of the members of the Solidity dev team:

Generally, you should always only use the latest released version available, no prior version whatsoever. [...] We keep a list of security relevant bugs known to be present in each compiler version in https://github.com/ethereum/solidity/blob/develop/docs/bugs_by_version.json. Generally, fixes are not backported across breaking releases (i.e. once 0.8.0 is released, 0.7.x won't be updated anymore). So you always want to use the most recent breaking release series. In the most recent breaking release series there will be backwards-compatible minor releases that may introduce non-breaking features and fix bugs - again it's always best to use the most recent one. So unless you have a compelling reason not to use it, the most recent released version should always be preferred and if any tooling does not yet support it, I'd suggest to pressure them to update. In case you really have to use an older release, be sure to at least check the relevant entries to the bug list.

However, we've seen times and times again that security researchers do find bugs in the most recent versions of solidity. Therefore, it is not clear how to determine the best trade-off between using recent solidity language features and also being fairly confident that enough security researchers have poked the compiler corresponding to that version of solidity and there's not many other things that can be found.

I've seen this question pop-up a bunch of times: "is version 0.x.x safe to use in production?" Therefore, I'm wondering if there is a clear way to tell which versions are recommended for production (Mainnet) and which are not. For example, running the latest version of Slither suggests using 0.6.11 https://github.com/crytic/slither/blob/081a0717efbf983c567602d982a09780f7d74920/slither/detectors/attributes/incorrect_solc.py#L50

When this question was asked on the official solidity gitter, the following answer was provided by one of the members of the Solidity dev team:

Generally, you should always only use the latest released version available, no prior version whatsoever. [...] We keep a list of security relevant bugs known to be present in each compiler version in https://github.com/ethereum/solidity/blob/develop/docs/bugs_by_version.json. Generally, fixes are not backported across breaking releases (i.e. once 0.8.0 is released, 0.7.x won't be updated anymore). So you always want to use the most recent breaking release series. In the most recent breaking release series there will be backwards-compatible minor releases that may introduce non-breaking features and fix bugs - again it's always best to use the most recent one. So unless you have a compelling reason not to use it, the most recent released version should always be preferred and if any tooling does not yet support it, I'd suggest to pressure them to update. In case you really have to use an older release, be sure to at least check the relevant entries to the bug list.

However, we've seen time and time again that security researchers do find bugs in the most recent versions of solidity. Therefore, it is not clear how to determine the best trade-off between using recent solidity language features and also being fairly confident that enough security researchers have poked the compiler corresponding to that version of solidity and there's not many other things that can be found.