First Flight #8: Math Master

Summary

The specified pragma in the library is pragma solidity ^0.8.3;, while custom errors were introduced in Solidity version 0.8.4. This mismatch can lead to compilation errors when the library is used with Solidity 0.8.3.

Quote from https://soliditylang.org/blog/2021/04/21/custom-errors/

Starting from Solidity v0.8.4, there is a convenient and gas-efficient way to explain to users why an operation failed through the use of custom errors.

Vulnerability Details

The issue arises due to the library’s pragma statement specifying compatibility with Solidity versions starting from 0.8.3 (pragma solidity ^0.8.3;). Since custom errors are only supported in Solidity 0.8.4 and later, any contract using Solidity 0.8.3 and attempting to leverage this library will encounter compilation failures.

Impact

The primary impact is on the usability and compatibility of the MathMasters library. Developers using Solidity 0.8.3 will be unable to compile contracts that include this library, leading to potential integration issues and hindering the library's adoption. It also raises concerns about the library's maintenance and the accuracy of its documentation regarding version compatibility.

Tools Used

Manual revision

Recommendations

To resolve this issue, the recommended approach is to update the pragma statement in the MathMasters library to reflect the minimum compatible Solidity version that supports custom errors. The updated pragma should be pragma solidity ^0.8.4;. This change will ensure that the library is not inadvertently used with incompatible Solidity versions and will provide clarity on the version requirements for potential users of the library.