pragma-and-addresses

# Pragma & address-hygiene detection ## When this applies - Top of every Solidity file - Constants and immutables typed `address` - Constructor / initializer parameters typed `address` - `mapping(address => …)` updates - Any cross-chain deployment where addresses differ per chain ## Detection patterns ### Floating pragma (LOW-MEDIUM) ```solidity pragma solidity ^0.8.0; // ← floats to any 0.8.x ``` Production deployments should pin: `pragma solidity 0.8.24;`. Floating pragma means audited bytecode ≠ deployed bytecode. ### Outdated Solidity version (MEDIUM) `<0.8.0` lacks built-in overflow checks. `<0.8.20` lacks PUSH0 opcode handling for some L2s. Audit pin date vs known compiler bugs. ### Hardcoded address tied to a single chain (HIGH) ```solidity address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2; // ← mainnet WETH, breaks on Base/Arbitrum ``` WETH/USDC/USDT all have *different* addresses per chain. Use a chain-configurable resolver. ### Missing zero-address check (HIGH on key fields) ```solidity function setOwner(address newOwner) external onlyOwner { owner = newOwner; // ← if 0x0, contract is bricked } ``` Affects ownership, oracles, treasury, fee receiver, token addresses. ### Address(0) as default sentinel (MEDIUM) Using `address(0)` to mean "unset" works but is brittle — collides with default mapping values. ### `payable(0)` as burn (LOW-MEDIUM) Burning by sending to `address(0)`'s payable is legal but locks ether forever. Document int...