# Breaking changes coming with Secure Cadence release! **URL:** \ **Category:** Uncategorized\ **Created:** [April 27, 2022, 11:12pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052 "2022-04-27T23:12:13Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Jan](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/jan/32/672_2.png) [@Jan](https://forum.flow.com/u/Jan)\ **Post date:** [April 27, 2022, 11:12pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/1 "2022-04-27T23:12:14Z")
> Update 9th June > Hi Everyone, we have released the latest versions of all developer tools updated to Secure Cadence: > > - [Cadence v0.24.3 (Secure Cadence)](https://github.com/onflow/cadence/releases/tag/v0.24.3) > - [Emulator v0.33.1](https://github.com/onflow/flow-emulator/releases/tag/v0.33.1) > - [CLI v0.36.0](https://github.com/onflow/flow-cli/releases/tag/v0.36.0) > - [Go SDK v0.26.2](https://github.com/onflow/flow-go-sdk/releases/tag/v0.26.2) > Update 10th May > Hi Everyone, we wanted to let you all know that our amazing community member Jacob [recorded this video](https://youtu.be/58poY8ZiHoo) to help you with updating your contracts, definitely work watching! Hello developers, We want to make everyone aware that there are breaking changes planned for the upcoming June Testnet & Mainnet Spork that will impact the majority of smart contracts deployed. These changes represent a critical step in the [Path to Stable Cadence and Permissionless Deployment](http://forum.flow.com/t/permissionless-contract-deployment-progress/2981), a milestone we’re calling Secure Cadence. [The Secure Cadence milestone is focused on code-hardening](http://forum.flow.com/t/update-on-path-to-stable-cadence-announcing-secure-cadence-milestone/2859) and will enable the deployment of smart contracts on Mainnet. A future update, called Stable Cadence, will focus on usability improvements. Splitting these into two milestones reduces the complexity, which helps spread the lift required from teams impacted by these changes. Please review this critical information below. ## Key Dates _Disclaimer: These dates could change pending any findings during the ongoing securuity auditing and testing of the Cadence release candidate_ - **Testnet Deployment:** June 8: We are shipping these changes to Testnet a week earlier, so that developers can test these changes - **Mainnet Deployment:** June 15 Note that the time between the sporks is longer than usual. During this time Testnet and Mainnet will run two different, incompatible versions of Cadence. ## What You Need To Do EVERYONE who has contracts on Testnet and Mainnet NEEDS to follow these steps to make sure your contracts are ready for the breaking changes. - Flow core contributors [created a tool which you can use to find breaking changes](http://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059) - Test your contracts with the latest Emulator build `v0.33.1-sc-m5`, which includes the Secure Cadence changes: - **To test with the CLI:** Install the Flow CLI with an integrated Secure Cadence Emulator (see more info on Emulator in the [Emulator documentation](https://docs.onflow.org/emulator/)): - **To test with the SDK with an integrated Emulator:** Get the Emulator with secure cadence [here](https://github.com/onflow/flow-emulator/pull/127). This uses these special versions of Cadence, the Emulator, and the SDK: ```jsx github.com/onflow/cadence v0.24.1 github.com/onflow/flow-emulator v0.33.1 github.com/onflow/flow-go-sdk v0.26.1 ``` - Keep a local build ready to test end-to-end changes on Testnet after June 8th - After the Mainnet deployment, the network will be **permissionless for all existing contracts** - this means you will be able to [update your contracts](https://docs.onflow.org/dapp-development/mainnet-deployment/#updatere-deploy-a-contract-on-mainnet-using-the-cli) immediately after the network is up after the spork without requiring any voucher or review. If you have identified any impact then you will need to upgrade those contracts (You will be able to do that by yourself and without any approval or review from the Flow core team). Note: Permissionless deployments of new contracts will be enabled shortly after the mainnet spork. See how to update: If you need any help with the code review and impact analysis, please [leave a question on the forums](http://forum.flow.com/c/builders/cadence/9), or reach out for help [on the Flow Discord](http://discord.gg/flow). **Please review the list of Breaking Changes below.** ## Breaking Changes ### Taking a reference to an optional value now produces an optionally-typed reference > 💡 Can be identified via analysis tool. - **Change description:** - **Update instructions:** Developers will need to add optional `?` markers to their dictionary references to comply with the new typing rules. They can replicate the old behavior by using the `!` forcing operator on the reference value. However, it is recommended that developers properly `nil` check their references instead of forcing them. For example, code that used to look like this: - [https://github.com/onflow/cadence/pull/1303](https://github.com/onflow/cadence/pull/1303) ### Mutation of container-typed fields is now limited to the scope of the enclosing composite > 💡 Can be identified via analysis tool. - **Change description:** - **Update instructions:** - [https://github.com/onflow/cadence/pull/1267](https://github.com/onflow/cadence/pull/1267) ### The `load`, `copy` and `borrow` functions now perform a force cast > 💡 Can be identified via analysis tool. - **Change description:** `load` `copy` and `borrow` no longer return `nil` when the type of the value in storage does not match the supplied argument. Instead, a runtime error is produced. More information about this change can be found in this FLIP: [https://github.com/onflow/flow/pull/718](https://github.com/onflow/flow/pull/718) - **Update instructions:** Developers will need to audit the uses of these functions to ensure they are never called with the incorrect type. In locations where developers wanted the `nil` returning behavior if the stored value had the wrong type, they can use the new `type` function on `AuthAccount` to check the type of a value in storage ([https://docs.onflow.org/cadence/language/accounts/#account-storage-api](https://docs.onflow.org/cadence/language/accounts/#account-storage-api)) - [https://github.com/onflow/cadence/pull/1286](https://github.com/onflow/cadence/pull/1286) ### Missing commas in parameter lists are now reported as an error > 💡 Can be identified via analysis tool. - **Change description:** The parser ignored missing commas in parameter lists. The parser now reports an error when the comma is missing. For example, the following program was accepted, but should have not, and is now rejected: - **Update instructions:** Ensure parameter lists contain commas where necessary. - [https://github.com/onflow/cadence/pull/1073](https://github.com/onflow/cadence/pull/1073) ### String representations of addresses are now zero-padded > 💡 Can be identified via analysis tool. - **Change description:** Converting an address to a string now zero-pads the result. For example: - **Update instructions:** Ensure your code does not rely on the non-padded representation of addresses - [https://github.com/onflow/cadence/pull/1214](https://github.com/onflow/cadence/pull/1214) ### The type checker now infers the **common super-type for expressions** > 💡 Can be identified via analysis tool. - **Change description:** - **Update instructions:** - [https://github.com/onflow/cadence/pull/1027](https://github.com/onflow/cadence/pull/1027) ### Arithmetic, comparison ,and bitwise operations on number super-types are now invalid > 💡 Can be identified via analysis tool. - **Change description:** - **Update instructions:** - [https://github.com/onflow/cadence/pull/1360](https://github.com/onflow/cadence/pull/1360) ### The representation of character values was fixed > ⚠ Cannot be identified via static code analysis tool. - **Change description:** - **Update instructions:** `Character` values can be converted to strings using the `.toString()` method; any type errors that may arise as a result of certain operations producing `Character` values instead of strings can be fixed by calling this method on the `Character` in question. - [https://github.com/onflow/cadence/pull/1392](https://github.com/onflow/cadence/pull/1392) ### The representation of types in JSON data changed > ⚠ Cannot be identified via static code analysis tool. - **Change description:** - [https://github.com/onflow/cadence/pull/1202](https://github.com/onflow/cadence/pull/1202) ---
**Author:** ![sylv1un](https://avatars.discourse-cdn.com/v4/letter/s/aeb1de/32.png) [@sylv1un](https://forum.flow.com/u/sylv1un)\ **Post date:** [April 28, 2022, 9:48am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/2 "2022-04-28T09:48:23Z")
Hi, Scuse me but when I want install the Flow CLI with an integrated Secure Cadence Emulator and I run your command (for macos): `sh -ci "$(curl -fsSL [https://raw.githubusercontent.com/onflow/flow-cli/master/install.sh](https://raw.githubusercontent.com/onflow/flow-cli/master/install.sh))" -- v0.33.1-sc-m5` I have this error : `zsh: unknown file attribute: h` Can you help me please ? For information I have already flow-cli installed on version v0.33.1. May be it’ s already ok for my flow-cli ? I would like to be sure to have secure Cadence Emulator integrated ? Thanks. ---
**Author:** ![Jan](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/jan/32/672_2.png) [@Jan](https://forum.flow.com/u/Jan)\ **Post date:** [April 28, 2022, 2:34pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/3 "2022-04-28T14:34:31Z")
Hi @sylv1un, somehow markdown sneaked into the install command, this was fixed now, please try again! Regards, Jan ---
**Author:** ![sylv1un](https://avatars.discourse-cdn.com/v4/letter/s/aeb1de/32.png) [@sylv1un](https://forum.flow.com/u/sylv1un)\ **Post date:** [April 28, 2022, 2:56pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/4 "2022-04-28T14:56:58Z")
It is perfect !! Thank you 👌 ---
**Author:** ![beppeben](https://avatars.discourse-cdn.com/v4/letter/b/5f9b8f/32.png) [@beppeben](https://forum.flow.com/u/beppeben)\ **Post date:** [April 28, 2022, 10:34pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/5 "2022-04-28T22:34:20Z")
Does the force casting only concern the borrow() method of AuthAccount, or also the same method of a Capability? It seems to be the former from a first test. ---
**Author:** ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)\ **Post date:** [April 29, 2022, 2:03am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/6 "2022-04-29T02:03:59Z")
The Flow core contributors created a tool which you can use to analyze your Cadence contracts, check it out here: [Secure Cadence Breaking Changes Analyzer](http://forum.flow.com/t/secure-cadence-breaking-changes-analyzer/3059) ---
**Author:** ![sylv1un](https://avatars.discourse-cdn.com/v4/letter/s/aeb1de/32.png) [@sylv1un](https://forum.flow.com/u/sylv1un)\ **Post date:** [April 29, 2022, 11:29am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/7 "2022-04-29T11:29:27Z")
Hi, **I have 2 questions** ( at the moment 😉 ) : **1)** if I deploy my contracts and run transactions correctly without any problem on emulator with last version v0.33.1, does this mean that I will have no problem with my contracts concerning the changes upcomming ? **2)** When I run the “Secure Cadence Breaking Changes Analyzer” (to test this tool) on the NFTStorefront contract I get severals errors : **for example :** `error: check required: storage read operations will perform a force-cast` `cut.receiver.borrow()` ` | ^^^^^^^^^^^^^^^^^^^^^ ensure the new behaviour is supported` at the line 165. **Another example :** `error: update required: reference to optional will return optional reference` `return &self.listings[listingResourceID] as! &Listing{ListingPublic}` `| ^^^^^^^^^^^^^^^^^^^^^^^ replace with '&Listing{ListingPublic}?'` at the line 456 When I check the “NFTStorefront.cdc” mainnet contract, I don’t see any changes. Does this mean that these modifications are not necessary or that they will be made later ? Thanks for your help 🙂 ---
**Author:** ![onkelskrue](https://avatars.discourse-cdn.com/v4/letter/o/eada6e/32.png) [@onkelskrue](https://forum.flow.com/u/onkelskrue)\ **Post date:** [April 29, 2022, 8:36pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/8 "2022-04-29T20:36:16Z")
> [@Jan](#): > > to satisfy the stricter type checking. However, to benefit from the increased safety of this change, it would be preferred to write the above code this way instead: > > ```auto > pub fun borrowNFT(id: UInt64): &NonFungibleToken.NFT? { > return &self.ownedNFTs[id] as &NonFungibleToken.NFT? > } > > ``` > > and then `nil`-checking the result of `borrowNFT` before using it. Thanks for the amazing work. I am trying to fix the breaking changes in my code, but don’t understand why this fails when deploying my contracts (vscode does not show any errors). ```swift pub fun borrowBid(id: UInt64): &BidCollection.Bid { pre { self.bids[id] != nil: "Bid with given id was not found" } return (&self.bids[id] as &BidCollection.Bid?)! } ``` however, I am getting following error which makes no sense: ```auto error: cannot create reference --> f8d6e0586b0a20c7.BidCollection:117:38 | 117 | return (&self.bids[id] as &BidCollection.Bid?)! | ^^^^^^^^^^^^^^^^^^^^^^^^^ expected reference type, got `&BidCollection.Bid?` ``` here is the signature of `Bid`: ```swift pub resource Bid: BidDetails, BidAccept ``` and `self.bids`: ```swift pub let bids: @{UInt64: BidCollection.Bid} ``` ---
**Author:** ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)\ **Post date:** [April 29, 2022, 10:35pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/9 "2022-04-29T22:35:34Z")
> [@sylv1un](#): > > **1)** if I deploy my contracts and run transactions correctly without any problem on emulator with last version v0.33.1, does this mean that I will have no problem with my contracts concerning the changes upcomming ? No, as pointed out above, you must test with version `v0.33.1-sc-m5`. > [@sylv1un](#): > > **2)** When I run the “Secure Cadence Breaking Changes Analyzer” (to test this tool) on the NFTStorefront contract I get severals errors : > **for example :** > `error: check required: storage read operations will perform a force-cast` > > `cut.receiver.borrow()` > ` | ^^^^^^^^^^^^^^^^^^^^^ ensure the new behaviour is supported` > at the line 165. > > **Another example :** > `error: update required: reference to optional will return optional reference` > > `return &self.listings[listingResourceID] as! &Listing{ListingPublic}` > `| ^^^^^^^^^^^^^^^^^^^^^^^ replace with '&Listing{ListingPublic}?'` > at the line 456 > > When I check the “NFTStorefront.cdc” mainnet contract, I don’t see any changes. Does this mean that these modifications are not necessary or that they will be made later ? Until the spork, contracts **cannot** be updated yet, they must be updated _after_ spork. Contracts like `NFTStorefront` also need to get updated. ---
**Author:** ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)\ **Post date:** [April 29, 2022, 10:38pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/10 "2022-04-29T22:38:43Z")
> [@onkelskrue](#): > > I am trying to fix the breaking changes in my code, but don’t understand why this fails when deploying my contracts (vscode does not show any errors). > > ```auto > pub fun borrowBid(id: UInt64): &BidCollection.Bid { > pre { > self.bids[id] != nil: "Bid with given id was not found" > } > return (&self.bids[id] as &BidCollection.Bid?)! > } > > ``` > > however, I am getting following error which makes no sense: > > ```auto > error: cannot create reference > --> f8d6e0586b0a20c7.BidCollection:117:38 > | > 117 | return (&self.bids[id] as &BidCollection.Bid?)! > | ^^^^^^^^^^^^^^^^^^^^^^^^^ expected reference type, got `&BidCollection.Bid?` > > ``` The update looks good. Are you sure you are testing the updated code with the Secure Cadence emulator? Note that you must use version `v0.33.1-sc-m5` ---
**Author:** ![onkelskrue](https://avatars.discourse-cdn.com/v4/letter/o/eada6e/32.png) [@onkelskrue](https://forum.flow.com/u/onkelskrue)\ **Post date:** [April 29, 2022, 10:55pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/11 "2022-04-29T22:55:51Z")
Weird. I checked `flow version` (was `v0.33.1-sc-m5`), re-started my machine, re-installed vscode extension etc. earlier, but it did not work. I tried to delete everything related to flow now, re-installed then it worked. ---
**Author:** ![sylv1un](https://avatars.discourse-cdn.com/v4/letter/s/aeb1de/32.png) [@sylv1un](https://forum.flow.com/u/sylv1un)\ **Post date:** [April 30, 2022, 9:04am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/12 "2022-04-30T09:04:16Z")
Ok thank you very much for this perfect response. 👍 🙏 ---
**Author:** ![onkelskrue](https://avatars.discourse-cdn.com/v4/letter/o/eada6e/32.png) [@onkelskrue](https://forum.flow.com/u/onkelskrue)\ **Post date:** [April 30, 2022, 12:06pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/13 "2022-04-30T12:06:28Z")
I am getting this weird error when passing params of `Capability`: ![image](https://us1.discourse-cdn.com/flex022/uploads/flow/original/1X/c117ae523412073574ac2e3647ecfb872fa8e771.png) The code is here if you want to test: [https://github.com/onkel-skrue/test-secure-cadence/blob/main/cadence/Test.cdc#L10](https://github.com/onkel-skrue/test-secure-cadence/blob/main/cadence/Test.cdc#L10) Edit: I can still deploy the contract. Edit: Found out that this is known and will be fixed next week according to Discord. ---
**Author:** ![Destructor](https://avatars.discourse-cdn.com/v4/letter/d/58f4c7/32.png) [@Destructor](https://forum.flow.com/u/Destructor)\ **Post date:** [May 9, 2022, 4:15pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/14 "2022-05-09T16:15:19Z")
Heya folks! is there a change in secure cadence when I want to typecast the `UFix64` to `UInt64`? I know there is a change when doing arithmetic, comparison, and bitwise operation. Right now below is the statement that I am using in my pre-condition ```auto expiry > UInt64(getCurrentBlock().timestamp) : "Expiry should be in future" ``` It is working fine, but as per the secure cadence do I have to change it? I am using flow CLI version - `Version: v0.33.1-sc-m5` and latest `flow-js-testing` library i.e `^0.2.3-alpha.6` ---
**Author:** ![bastian](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/bastian/32/183_2.png) [@bastian](https://forum.flow.com/u/bastian)\ **Post date:** [May 9, 2022, 4:19pm UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/15 "2022-05-09T16:19:35Z")
> [@Destructor](#): > > is there a change in secure cadence when I want to typecast the `UFix64` to `UInt64`? To clarify, `UInt64(number)` calls the number conversion function `UInt64`, this is not type casting – type casting is done using the `as`/`as?`/`as!` operators. Neither number conversion functions nor type casts have changed. If you see any problems with these, please let us know. ---
**Author:** ![phill](https://avatars.discourse-cdn.com/v4/letter/p/779978/32.png) [@phill](https://forum.flow.com/u/phill)\ **Post date:** [May 19, 2022, 8:55am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/16 "2022-05-19T08:55:19Z")
Was wondering if this known bug relating to dependency tracking of imports in the language server/vs code has been addressed yet, as it is still causing me issues? ![image](https://us1.discourse-cdn.com/flex022/uploads/flow/original/1X/dbcc88f3225d62c28db6ebc3181b975dbbdb366b.png) The impact of this is that any of my contracts that include the FungibleToken.Receiver restricting type cannot be imported into any other contracts. The vs code extension identifies the problem as “checking of imported program `./.cdc` failed”. Since the imports on my contracts are broken, by extension, the imports on my txs and scripts are also broken. This means that I when I run my flow-js-testing test suite, all tests that involve these erroring txs/scripts/contracts fail, where previously (Flow CLI v0.33.1) they didn’t. Here is the Discord thread that raises the problem. > **[Discord - A New Way to Chat with Friends & Communities](https://discord.com/channels/613813861610684416/969834045976498186)** > > Discord is the easiest way to communicate over voice, video, and text. Chat, hang out, and stay close with your friends and communities. My versions: Flow CLI: v0.33.1-sc-m6 flow-js-testing: ^0.2.3-alpha.5 Thanks! ---
**Author:** ![sideninja](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/sideninja/32/363_2.png) [@sideninja](https://forum.flow.com/u/sideninja)\ **Post date:** [May 20, 2022, 8:50am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/17 "2022-05-20T08:50:06Z")
@phill apologies for the problems with the vscode, can you try to install the CLI version `v0.33.2-sc-m6`. ---
**Author:** ![Babayaga](https://avatars.discourse-cdn.com/v4/letter/b/848f3c/32.png) [@Babayaga](https://forum.flow.com/u/Babayaga)\ **Post date:** [May 23, 2022, 9:10am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/18 "2022-05-23T09:10:55Z")
is the emulator network also not updated? so we cannot run analyzer on emulator-deployed contracts? ---
**Author:** ![Babayaga](https://avatars.discourse-cdn.com/v4/letter/b/848f3c/32.png) [@Babayaga](https://forum.flow.com/u/Babayaga)\ **Post date:** [May 23, 2022, 9:12am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/19 "2022-05-23T09:12:34Z")
i am on Version: v0.33.1-sc-m6, but am still seeing the same errors as @phill . I have closed on opened vscode multiple times ---
**Author:** ![sideninja](https://sea2.discourse-cdn.com/flex022/user_avatar/forum.flow.com/sideninja/32/363_2.png) [@sideninja](https://forum.flow.com/u/sideninja)\ **Post date:** [May 23, 2022, 9:25am UTC](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052/20 "2022-05-23T09:25:42Z")
@Babayaga can you try the v0.33.2-sc-m6 version as mentioned above. [Next page](https://forum.flow.com/t/breaking-changes-coming-with-secure-cadence-release/3052.md?page=2)