Solc version used (known-bug versions flagged)
Multipli's assessment for RD-F-170 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
All deployed V2 contracts use solc 0.8.30. This version is on the solc known-bug list: TransientStorageClearingHelperCollision (High, requires viaIR=true AND transient storage usage — neither condition met in deployed contracts: viaIR=false confirmed on VariableVaultFee on-chain metadata, no tload/tstore in MultipliVault source). LostStorageArrayWriteOnSlotOverflow (Low). VerbatimInvalidDeduplication (Low). High-severity bug trigger conditions absent from deployed code. Version is not at latest-safe (0.8.34+).
Sources #
- URLEtherscan solc bug info — 0.8.30 affected bugsEtherscan solcbuginfo — 0.8.30 bug listingretrieved 2026-05-17
- VariableVaultFee — viaIR=false in compiler settingsSnowtrace — VariableVaultFee metadata confirms viaIR=falseretrieved 2026-05-17
- Solidity blog — TransientStorageClearingHelperCollision bug postSolidity blog — TransientStorageClearingHelperCollision detailsretrieved 2026-05-17
Methodology #
Identify the Solidity compiler version used for deployed bytecode and flag if it appears on the known-bug list (solc bugs.json or Vyper 0.2.15–0.3.0 range).
See the full factor methodology and distribution across all protocols →