Deprecated Functions Remediation

Overview

Related Detector: Deprecated Functions

Deprecated built-ins — suicide(), sha3(), callcode(), throw, var, years — signal code written for an old compiler and often ship alongside other outdated, unsafe patterns. Some are outright removed in current Solidity. The remediation is to replace each with its modern equivalent and, ideally, recompile under a current, pinned compiler so the toolchain rejects the rest.

Recommended Fix

Before (Vulnerable / legacy)

function close() public {
    if (msg.sender != owner) throw;      // 'throw' is removed
    suicide(owner);                       // 'suicide' is removed
}

bytes32 h = sha3(data);                   // 'sha3' is removed

After (Fixed — modern equivalents)

function close() public {
    require(msg.sender == owner, "Not owner");   // require/revert
    selfdestruct(payable(owner));                 // selfdestruct (and note EIP-6780 semantics)
}

bytes32 h = keccak256(data);                      // keccak256

Deprecated	Replacement
`throw`	`require` / `revert` / custom errors
`suicide(a)`	`selfdestruct(payable(a))`
`sha3(x)`	`keccak256(x)`
`callcode`	`delegatecall`
`var`	explicit type

Note that selfdestruct itself is now discouraged: under EIP-6780 it only clears the account within the same transaction it was created, so do not rely on legacy self-destruct behaviour.

Common Mistakes

Replacing throw with a bare revert() that drops the error reason a monitor could have used.
Swapping suicide for selfdestruct without accounting for EIP-6780’s changed semantics.
Fixing the deprecated call but leaving the contract on an ancient pragma that permits other removed behaviour.