First Flight #9: Soulmate

Summary

The contracts of the Soulmate protocol use a wide version of Solidity: ^0.8.23.

Vulnerability Details

The Airdrop, LoveToken, Soulmate, Staking and Vault contracts use not specific pragma solidity version: ^0.8.23.
Also, in the README is said:

Solc Version: 0.8.23 < 0.9.0

But the used Solidity version in the contracts is: ^0.8.23. At this moment the last released solidity version is 0.8.25. But in the future when the 0.9.0 version is released, the contracts can use it which is not intended by the protocol.

Impact

Using a floating pragma ^0.8.23 statement is not recommended as code can compile to different bytecodes with different compiler versions.
Also, the Solidity pragma ^0.8.23 includes the Solidity version 0.9.0. This conflicts with the protocol's requirement that the Solidity version be less than 0.9.0.

Tools Used

Manual Review

Recommendations

Consider using a specific version of Solidity in your contracts instead of a wide version. Also, use latest Solidity version to get all compiler features, bugfixes and optimizations.