First Flight #6: Voting Booth

Summary

Solidity version 0.8.23 not compatible with Arbitrum chain.

Vulnerability Details

All of the contracts in scope have the version pragma fixed to be compiled using Solidity ^0.8.23 and foundry.toml file fixes it to 0.8.23. Since 0.8.20, it uses the new PUSH0 opcode introduced in the Shanghai hard fork, which is now the default EVM version in the compiler and the one being currently used to compile the project. The project intends to deploy to Arbitrum, but this chain does not support the Shanghai hard fork yet.

Impact

MEDIUM. Prevents deployment on Abritrum Chain for unknown opcode. Main risk relies if contract is deployed successfully for some reason, it can have bad unexpected consequences when during executions.

Tools Used

• Manual Review

Recommendations

Update solidity version to 0.8.19 (before the PUSH0 introduction), or even better, version 0.8.18, a more stable version and supported in Arbitrum