Solidity version 0.8.22 not compatible with Arbitrum chain
Summary
Solidity version 0.8.22 not compatible with Arbitrum chain.
Vulnerability Details
All of the contracts in scope have the version pragma fixed to be compiled using Solidity 0.8.22. Since 0.8.20, it uses the new PUSH0 opcode introduced in the Shanghai hard fork, which is now the default EVM version in the compiler and the one being currently used to compile the project. The project intends to deploy to Arbitrum, but this chain does not support the Shanghai hard fork yet.
reference
foundry.toml file specifies evm_version = "paris" but this is only for testing as stated in the Foundry docs here
Impact
MEDIUM. Prevents deployment on Abritrum Chain for unknown opcode. Main risk relies if contract is deployed successfully for some reason, it can have bad unexpected consequences when during executions.
Tools Used
Manual Review
Recommendations
Update solidity version to 0.8.19 (before the PUSH0 introduction), or even better, version 0.8.18, a more stable version and supported in Arbitrum
Lead Judging Commences
Incompatible Pragma Version on Arbi
Information on compatibility here: https://docs.arbitrum.io/for-devs/concepts/differences-between-arbitrum-ethereum/solidity-support Impact - failed deployment - Protocol would need to adjust their pragma versions to be compatible and redeploy
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.