maintenance(low): foundry.toml chain config drifted from the deployment set; floating pragma on a deployed contract

[pviti]

Severity: Low (maintenance). From the 2026-07-29 cross-repo audit.

Two build-config drifts that hurt reproducibility/verification:

• contracts/foundry.toml:26-38: [rpc_endpoints]/[etherscan] define moderato, tempo, celo-sepolia, plasma-testnet — while four of the six chains listed Live at 1.3.0 in the README (Arbitrum Sepolia, Base Sepolia, Optimism Sepolia, Polygon Amoy) have no entry. moderato appears nowhere in the README and tempo is documented as unable to run RAIL0 at all. Anyone redeploying/verifying must supply RPC/verifier URLs out-of-band, and the config implies support that does not exist.
• contracts/src/RAIL0.sol:2 uses a floating pragma solidity ^0.8.27; while foundry.toml pins solc = "0.8.27" + via_ir. A third party recompiling for verification with a newer 0.8.x can produce different bytecode than the deployed artifact; =0.8.27 removes the ambiguity for a contract with no upgrade path.

Suggested fix: align [rpc_endpoints]/[etherscan] with the actual deployment set; pin the pragma.

[pviti]

Verified fixed on v1.4.0 — and the reason this was still open

Both asks are satisfied on origin/v1.4.0 (via #65, merged 24 Aug). Checked file by file rather than trusting the commit title.

The pragma. Pinned to =0.8.31, matching solc = "0.8.31" in foundry.toml, in all five Solidity files:

file	pragma
src/RAIL0.sol	=0.8.31
src/interfaces/IEIP3009.sol	=0.8.31
src/interfaces/IERC20.sol	=0.8.31
script/Deploy.s.sol	=0.8.31
test/RAIL0.t.sol	=0.8.31

Wider than this issue asked — it named RAIL0.sol:2 alone — and that is the right call: the interfaces are compiled into the deployed bytecode, so a floating pragma on either of them reintroduces exactly the verification ambiguity the issue is about.

The build config. [rpc_endpoints] and [etherscan] now carry exactly the six chains the README lists as Live — arbitrum-sepolia, arc-testnet, base-sepolia, celo-sepolia, optimism-sepolia, polygon-amoy — each with a verifier endpoint and its chain id. moderato, tempo and plasma-testnet are gone, and the file now records why in a comment: Tempo cannot run RAIL0 at all, Plasma's testnet is still Planned, Moderato appeared nowhere in the README. Polygon Amoy is the single row that needs a key, because Polygonscan's V1 API is retired and it goes through Etherscan V2 — which is also why key is not just "" everywhere.

So why was it still open?

Because #65 merged into v1.4.0, not into main, and GitHub only creates closing links for a PR that targets the default branch. The same applies to every fix arriving through the release branch: #35, #36, #41, #68, #69. It is not a near-miss either — closingIssuesReferences on #74 was literally empty despite its body reading "closes #68, closes #69".

Fixed by putting the keywords where they actually work: the release PR #64 targets main and now carries all six, so they close together when the release ships. Nothing further to do in the contract.

Not backported to main, deliberately

main still carries ^0.8.27 for the deployed 1.3.0. Pinning it retroactively cannot change already-deployed bytecode, and a forge verification against main is deterministic anyway because foundry.toml pins solc there too. The only exposure left is a non-foundry recompile of a version v1.4.0 supersedes — not worth a commit on a released branch.