A defect or backdoor introduced by the compiler, library or build tooling used to produce software, rather than by the source code itself.
Why it matters
The reviewed artefact and the deployed artefact are not the same object. Source code can be audited, published and correct, and still compile to something that behaves differently — which places a dependency in the trusted base whether or not anyone examined it.
What you can check
Compiler and library versions are part of a deployment’s security surface. Projects that pin versions, publish the exact toolchain used, and support reproducible builds allow the deployed bytecode to be checked against the reviewed source; without that, the two are asserted to match rather than shown to.
Where it showed up
Records in the Incident Tracker that turn on this: Curve Finance Vyper reentrancy.
Not advice. Definitions are for understanding, not instruction. Nothing here is financial, legal, tax or security advice.