When Source Code Misleads: Detecting Compiler Version Risks in Smart Contracts

Solidity has undergone 116 version iterations between August 2015 and February 2026, during which compiler updates have introduced behavioral changes, including issues later fixed in subsequent releases. Contracts compiled under specific versions may exhibit version-dependent execution behaviors, particularly in low-level code. These differences are often difficult for developers and users to recognize, creating opportunities for adversaries to exploit legacy compiler behaviors and deploy contracts with potentially deceptive outcomes. We define this issue as the Compiler Version Discrepancy (CVD) risk, where attackers leverage compiler-version-dependent behaviors to produce misleading or unfair outcomes while contracts appear functionally benign. We summarize five representative CVD risk patterns from real compiler inconsistencies.To mitigate this risk, we develop the CompileGuard detection tool. It combines Abstract Syntax Tree (AST) analysis, taint analysis, and symbolic execution with Control Flow Graph (CFG) analysis to identify version-sensitive code patterns. Evaluation on 227 smart contracts shows CompileGuard achieves an overall F1 score of 95.22%. A user study with 21 blockchain practitioners shows contracts exploiting CVD risks can mislead users, while detection reports enable all participants to correctly identify risk-inducing behaviors. These results highlight the practical exploitability of CVD risks and the effectiveness of automated detection in preventing such deception.