Summary

All files is scope have solidity version fixed to 0.8.20. This version uses PUSH0 opcode which is not yet available on all EVM-compatible chains and L2s.

Details

All contracts in scope have solidity version fixed to 0.8.20. This version of the compiler uses the new PUSH0 opcode which was introduced in the Shanghai hardfork. This is now the default EVM version in the compiler.

Thunder Loan is currently on Ethereum chain only but it might eventually be on other chains and L2s such as Arbitrum for example.

Arbitrum does not yet support PUSH0 opcode (issue already raised here) so Thunder Loan might be deployed there with malformed bytecode which could introduce many unknown issues.

Filename

• src/protocol/AssetToken.sol

• src/protocol/OracleUpgradeable.sol

• src/protocol/ThunderLoan.sol

• src/upgradedProtocol/ThunderLoanUpgraded.sol

• src/interfaces/IFlashLoanReceiver.sol

• src/interfaces/IPoolFactory.sol

• src/interfaces/IThunderLoan.sol

• src/interfaces/ITSwapPool.sol

Permalinks

• https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/8539c83865eb0d6149e4d70f37a35d9e72ac7404/src/interfaces/IFlashLoanReceiver.sol#L2

• https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/8539c83865eb0d6149e4d70f37a35d9e72ac7404/src/interfaces/IPoolFactory.sol#L2

• https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/8539c83865eb0d6149e4d70f37a35d9e72ac7404/src/interfaces/ITSwapPool.sol#L2

• https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/8539c83865eb0d6149e4d70f37a35d9e72ac7404/src/interfaces/IThunderLoan.sol#L2

• https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/8539c83865eb0d6149e4d70f37a35d9e72ac7404/src/protocol/AssetToken.sol#L2

• https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/8539c83865eb0d6149e4d70f37a35d9e72ac7404/src/protocol/OracleUpgradeable.sol#L2

• https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/8539c83865eb0d6149e4d70f37a35d9e72ac7404/src/protocol/ThunderLoan.sol#L64

• https://github.com/Cyfrin/2023-11-Thunder-Loan/blob/8539c83865eb0d6149e4d70f37a35d9e72ac7404/src/upgradedProtocol/ThunderLoanUpgraded.sol#L64

Impact

Contracts might get deployed in malformed state and be completely unusable in other chains that do not yet support PUSH0 opcode.

Recommendations

Modify pragma in all in-scope contracts to exclude version 0.8.20. For example:

Tools Used

• Manual Audit

• Foundry