First high-severity Solidity compiler bug since 2016 discovered by Hexens, potentially corrupting contract storage across the ecosystem.
Security & Exploits ·
Security firm Hexens discovered TSTORE Poison, a high-severity vulnerability in the Solidity compiler affecting versions 0.8.28 through 0.8.33. The flaw causes a cache key collision in the via-ir code generator, silently swapping opcodes so that delete operations on transient variables emit the wrong storage instruction—either persisting data that should be temporary or failing to clear persistent storage. The bug shipped without warnings and produced bytecode that passed standard test suites, remaining undetected for 18 months.
The vulnerability creates multiple attack vectors depending on which opcode swap occurs: persistent storage corruption could enable fund drains, ownership theft, or access control bypasses, while failure to clear persistent state leaves permanent token approvals or reentrancy guard bypasses in place. The root cause traces to the Solidity compiler's MultiUseYulFunctionCollector, which caches helper functions by name alone; when the storage-clearing function was first introduced for transient variables in October 2024, the cache key did not account for storage domain type, causing all subsequent deletes of that type to inherit the wrong instruction.
The official Solidity team announcement recommends upgrading to solc 0.8.34 or later, recompiling, and redeploying affected contracts. Hexens used cross-chain scanning to assess ecosystem-wide exposure, though the total number of vulnerable contracts and the scope of real-world impact remain unclear.