Misordered named parameters bug blog post#205
Conversation
| layout: post | ||
| published: true | ||
| title: 'Misordered Named Parameters in require with Custom Errors Bug' | ||
| date: '2026-05-20' |
| category: Security Alerts | ||
| --- | ||
|
|
||
| On February 9, 2026, the Solidity team discovered a bug in the IR-based code generator that |
There was a problem hiding this comment.
Do we know the actual reporter (aside from the EF bug bounty), and should we use them instead of "Solidity team"?
czepluch
left a comment
czepluch
left a comment
There was a problem hiding this comment.
looks good. mostly cosmetic nits from my side.
|
|
||
| The bug was introduced in Solidity 0.8.26, which added support for passing custom errors as | ||
| the second argument to `require`. | ||
| [Solidity version 0.8.36](https://github.com/ethereum/solidity/releases/tag/v0.8.36), released on May 20, 2026, provides a fix. |
There was a problem hiding this comment.
update date when we 0.8.36
| --- | ||
| layout: post | ||
| published: true | ||
| title: 'Misordered Named Parameters in require with Custom Errors Bug' |
There was a problem hiding this comment.
| title: 'Misordered Named Parameters in require with Custom Errors Bug' | |
| title: 'Misordered Named Parameters in `require` with Custom Errors Bug' |
| category: Security Alerts | ||
| --- | ||
|
|
||
| On February 9, 2026, the Solidity team discovered a bug in the IR-based code generator that |
There was a problem hiding this comment.
Seems like a fairly long time to fix. Maybe worth mentioning in the next paragraph that due to the "very low" severity, it was not prioritized until now.
|
|
||
| The bug was introduced in Solidity 0.8.26, which added support for passing custom errors as | ||
| the second argument to `require`. | ||
| [Solidity version 0.8.36](https://github.com/ethereum/solidity/releases/tag/v0.8.36), released on May 20, 2026, provides a fix. |
There was a problem hiding this comment.
| [Solidity version 0.8.36](https://github.com/ethereum/solidity/releases/tag/v0.8.36), released on May 20, 2026, provides a fix. | |
| [Solidity 0.8.36](https://github.com/ethereum/solidity/releases/tag/v0.8.36), released on May 20, 2026, provides a fix. |
In the same paragraph, we say "Solidity 0.8.26", so let's be consistent. Past posts also omit "version"
| `require` and instantiated with named arguments in a non-declaration order - and only affects | ||
| the IR-based pipeline. | ||
|
|
||
| ## Which Contracts are Affected? |
There was a problem hiding this comment.
| ## Which Contracts are Affected? | |
| ## Which Contracts Are Affected? |
previous posts use a header style with all words capitalized.
| reorders arguments before encoding, and so are not affected. The bug is specific to the | ||
| `require`-with-custom-error path introduced in 0.8.26. | ||
|
|
||
| ### Misalignment with Mixed Stack Widths |
There was a problem hiding this comment.
| ### Misalignment with Mixed Stack Widths | |
| ### Misalignment With Mixed Stack Widths |
previous posts use a header style with all words capitalized.
| - `revert ErrorName({...})` statements, | ||
| - event emissions (`emit E({...})`), | ||
| - internal, external, library, and bound function calls, | ||
| - struct constructor invocations. |
There was a problem hiding this comment.
| - `revert ErrorName({...})` statements, | |
| - event emissions (`emit E({...})`), | |
| - internal, external, library, and bound function calls, | |
| - struct constructor invocations. | |
| - `revert ErrorName({...})` statements | |
| - event emissions (`emit E({...})`) | |
| - internal, external, library, and bound function calls | |
| - struct constructor invocations |
trailing commas on a bullet list reads weird, let's just remove trailing punctuation
| - event emissions (`emit E({...})`), | ||
| - internal, external, library, and bound function calls, | ||
| - struct constructor invocations. | ||
|
|
There was a problem hiding this comment.
Add something that explicitly states a workaround until upgrading:
Until upgrading, the bug can be avoided by writing the named arguments in declaration order, or by using positional arguments.
| any reordering - including reorderings of two arguments of the same type, where no positional | ||
| type mismatch could ever surface - which was the most surprising aspect of the bug. |
There was a problem hiding this comment.
It's a bit hard to read this sentence, since there's a comma inside the parenthetical dashes. Consider restructuring.
2 participants
Date TBD