Solidity Spill Slot Bug Fixed in Version 0.8.37

Published: 2026-09-11 04:07:59 |

Solidity has fixed a low-to-medium severity compiler bug, called the Spill Slot Collision Across Mutual Recursion Bug, in version 0.8.37. The bug affects contracts compiled through the IR pipeline with --via-ir and containing mutually recursive functions. Under narrow conditions, the compiler’s stack-to-memory mover could assign the same spill slot to two variables that were live at the same time. One variable could then overwrite the other, causing the contract to calculate or store a value not specified by the source code. Solidity versions 0.7.2 through 0.8.36 are affected. Before version 0.8.21, the optimizer was also required; from 0.8.21 onward, the issue could occur regardless of optimizer settings. Contracts using the legacy evmasm pipeline, contracts without mutual recursion, and projects that did not enable IR compilation are not affected. The Solidity team rescanned about 319,000 verified contracts through Sourcify and found no deployed contract known to be affected. The issue was reported by Ng Sze Hon through the Ethereum Foundation bug bounty programme. Developers are advised to upgrade to Solidity 0.8.37 or later before deploying IR-compiled contracts. Existing deployments using --via-ir and mutual recursion should undergo code review, especially where local variables are read after internal calls. The Solidity bug is unlikely to create broad market disruption, but it is relevant to smart-contract security, audits and Ethereum developer tooling.

Neutral

The expected market impact is neutral. This is a narrowly scoped Solidity compiler bug rather than a protocol exploit, exchange incident or loss of funds. The affected configuration requires IR compilation, mutual recursion and additional compiler-specific conditions, making real-world exposure uncommon. The Sourcify rescan of roughly 319,000 verified contracts found no known deployed contract with changed bytecode or confirmed impact. In the short term, the announcement may prompt developers, auditors and security teams to review contracts and upgrade compiler versions. That could create limited negative sentiment around affected applications, particularly if a vulnerable deployment is later identified, but there is no evidence of a systemic Ethereum failure or immediate selling catalyst. ETH trading is therefore more likely to follow broader market liquidity, network activity and macro indicators than this disclosure. Long term, the release of Solidity 0.8.37 and the addition of stronger call-graph and fuzz-testing safeguards should improve confidence in Ethereum smart-contract tooling. Similar compiler disclosures typically produce targeted remediation and temporary concern rather than sustained market-wide price pressure. Traders should monitor follow-up disclosures, affected application announcements and any exploit confirmation, but the current information supports a neutral classification.