Summary

It's been relayed in the public discord chat that DSC would be deployed in EVM compatible chains, but Arbitrum is not compatible with Solidity version 0.8.20, which has not been accounted for.

Vulnerability Detail

Floating pragma is used, allowing the contracts to be compiled with any 0.8.x compiler higher than the specified version. The problem with this is that Arbitrum is NOT compatible with 0.8.20 and newer due to the introduction of a new opcode PUSH0. Contracts compiled with those versions will result in a nonfunctional or potentially damaged version that won't behave as expected. The default behaviour of compiler would be to use the newest version which would mean by default it will be compiled with the 0.8.20 version which will produce broken code.

Impact

Damaged or nonfunctional contracts when deployed on Arbitrum.

Tool used

Manual Audit

Recommendation

Constrain pragma could be something as follows:

pragma solidity >=0.8.18 <=0.8.19