First Flight #5: Santa's List

Summary

Currently the protocol is using 0.8.22 compiler version. The PUSH0 opcode introduced in 0.8.20 is not supported on Arbitrum. (This is a more gas-efficient way to push 0 on top of the stack). This creates compatibility issues, where contracts compiled with these versions may deploy but fail to function or return incorrect values.

Here is a Medium finding from a bot report from code4rena for an ongoing audit of the Shell protocol:

"
[M-03] Contracts are completely non-functional due to incompatible Solidity version with Arbitrum
The Shell Protocol V2 is currently live on Arbitrum mainnet (see https://app.shellprotocol.io/). This audit is for V3 and uses version 0.8.20 of Solidity whereas V2 used version 0.8.10 (see Shell github). The compiler for Solidity 0.8.20 switches the default target EVM version to Shanghai, which includes the new PUSH0 op code. This op code may not yet be implemented on all L2s, so deployment on these chains will fail. See this relevant issue on the official Solidity github for reference. As the contract(s) are intended to be deployed on Arbitrum, this will cause them to be completely non-functional. To work around this issue, use an earlier EVM version, such as 0.8.19.
"

Impact

• Reputation risk due to failed contract deployment or loss of user funds if function results return incorrect values.

Tools Used

• https://github.com/code-423n4/2023-11-shellprotocol/blob/main/bot-report.md#m-03

• https://github.com/ethereum/solidity/issues/14254

• https://docs.arbitrum.io/for-devs/concepts/differences-between-arbitrum-ethereum/solidity-support

Recommendations

Downgrade all contracts to version 0.8.19.