Beedle - Oracle free perpetual lending

Summary

Vulnerability Details

The contract contains "^" while defining the solidity version. It means that it will accept any solidity version at that version or the latest one. Compiling with a newly released version of solidity may result in the code having multiple bugs which would be fixed over time but the contract would already be using it which might result in unexpected behavior.

Impact

The compiler for Solidity 0.8.20 switches the default target EVM version to Shanghai, which includes the new PUSH0 opcode. This opcode may not yet be implemented on all L2s, so deployment on these chains will fail. To work around this issue, use an earlier & fixed EVM version. While the project itself may or may not compile with 0.8.20, other projects with which it integrates, or which extend this project may, and those projects will have problems deploying these contracts/libraries.

Tools Used

Manual Review

Recommendations

Use a fixed solidity version.