foundry.toml compiler settings sit inside [soldeer], so forge ignores every one of them

[thedavidmeister]

foundry.toml declares its compiler settings after the [soldeer] header, so TOML assigns them to [soldeer] and forge never reads them. The repo builds — and publishes — on foundry defaults instead.

13 [soldeer]
14 recursive_deps = false
15
16 # See more config options https://github.com/foundry-rs/foundry/tree/master/config
17
18 solc = "0.8.25"
...
28 optimizer = true
29 optimizer_runs = 1000000
30
31 bytecode_hash = "none"
32 cbor_metadata = false
33
34 evm_version = "cancun"

Everything from line 18 to line 34 is inside [soldeer]. [profile.default] ends at line 8 with src/out/libs.

What forge actually uses

forge config on main reports optimizer = false, optimizer_runs = 200, bytecode_hash = "ipfs", cbor_metadata = true, and an evm_version of the toolchain's default rather than cancun — the foundry defaults, not this file's values. Moving solc and evm_version under [profile.default] on a scratch copy makes forge config report 0.8.25 and cancun, which confirms the cause is the section, not the values.

Why it matters

• Every published Soldeer revision is compiled unoptimised on a default solc and EVM version, not the pinned 0.8.25/cancun this file believes it sets.
• bytecode_hash = "none" and cbor_metadata = false are likewise inert, so the artifacts carry an IPFS metadata hash and are not byte-reproducible across machines.
• The comment at line 27 — "These settings should be used for snapshots" — describes settings that have never been in effect.

Fix

Move lines 18–34 into [profile.default], above [dependencies]. Then verify with forge config that solc, optimizer, optimizer_runs, bytecode_hash, cbor_metadata and evm_version all report the file's values rather than the defaults — the check that would have caught this.

Worth sweeping the sibling repos for the same shape: any foundry.toml with profile keys sitting after a [dependencies] or [soldeer] header has the same silent bug. (rain.solmem's ordering is correct — its settings sit under [profile.default] before [dependencies].)

Found while implementing #35; independent of that change, and #36 neither causes nor fixes it.

[thedavidmeister]

Two claims in this issue are wrong. Correcting them here so the next reader
doesn't act on them. The diagnosis and the fix are right; only the impact
statements are.

"Every published Soldeer revision is compiled unoptimised on a default solc
and EVM version." Soldeer publishes source, not artifacts. .soldeerignore
excludes /out, /foundry.toml, /cache, /dependencies and /test, so a
revision is src/** plus README and LICENSES. LibCtPop's two functions are
both internal, so they are inlined into the consumer's own compilation unit
and compiled entirely under the consumer's settings. Nothing about this repo's
optimizer, solc, evm_version, bytecode_hash or cbor_metadata has ever
reached a consumer, and no published revision needs republishing.

"The comment at line 27 describes settings that have never been in effect."
They were in effect from 2024-06-09 (ab2fe4d) until 2026-05-09, when the
soldeer migration (73a6669) inserted [dependencies] and [soldeer] between
[profile.default] and the rest of the file. Before that commit every setting
sat under [profile.default] and forge read all of them. That is checkable
against the committed .gas-snapshot: it holds the optimised numbers, which
main today cannot reproduce.

Two further corrections from building it both ways in #38:

• evm_version was inert but not wrong. The old build's artifact metadata
  reads evmVersion: cancun, because foundry clamps the requested EVM version
  down to the newest one the selected solc supports and 0.8.25 tops out at
  cancun. The osaka that forge config reports never reached the compiler.
• solc was likewise inert but not wrong: auto_detect_solc resolved to
  0.8.25 anyway, because the test pins pragma solidity =0.8.25.

What the defect actually cost is this repo's own builds and CI: unoptimised, at
optimizer_runs = 200, with an IPFS metadata hash in every artifact, so builds
were not byte-reproducible across machines. Fixed in #38.