Solc version used (known-bug versions flagged)
Superstate's assessment for RD-F-170 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Current USTB and USCC implementations deploy with solc v0.8.28+commit.7893614a (optimizer 1M runs). TransientStorageClearingHelperCollision is a high-severity bug in solc 0.8.28-0.8.33 (fixed in 0.8.34). However, this bug requires two simultaneous conditions: (1) transient storage usage (tstore/tload/transient keyword) AND (2) IR-based code generator (viaIR=true). GitHub raw foundry.toml confirms both are commented out (#via-ir = true; #optimizer = true). SuperstateToken.sol source contains no transient storage usage. Deployed Etherscan metadata confirms no viaIR in the build. The bug is therefore non-applicable to the deployed contracts. Scored yellow (on known-bug list with high bug that is non-applicable due to absent prerequisites) per conservative application of the yellow criterion.
Sources #
- URLEtherscan Solc Bug Info (TransientStorageClearingHelperCollision)Etherscan solcbuginfo: TransientStorageClearingHelperCollision high-severity affects 0.8.28-0.8.33; requires viaIR=true AND transient storage useretrieved 2026-05-16
- superstateinc/ustb foundry.toml (viaIR disabled)foundry.toml: solc_version=0.8.28; #via-ir = true (commented out); #optimizer = true (commented out)retrieved 2026-05-16
- superstateinc/ustb SuperstateToken.sol (no transient storage)SuperstateToken.sol source confirmed: no tstore/tload/transient keyword usageretrieved 2026-05-16
- Etherscan SuperstateTokenV5_1 compiled with v0.8.28SuperstateTokenV5_1 0x1f50a1EE compiler metadata: v0.8.28+commit.7893614a, optimizer 1M runs, no viaIRretrieved 2026-05-16
Methodology #
Identify the Solidity compiler version used for deployed bytecode and flag if it appears on the known-bug list (solc bugs.json or Vyper 0.2.15–0.3.0 range).
See the full factor methodology and distribution across all protocols →