First Flight #14: AirDropper

Summary

The Solidity compiler version 0.8.20 introduces a bytecode optimization that utilizes PUSH0 opcodes for gas efficiency. However, this may cause deployment issues on EVM implementations, such as certain L2 chains, like zkSync, that do not support PUSH0.

Vulnerability Details

Notice that the Solidity compiler version for the contract MerkleAirdrop.sol is 0.8.24.

Impact

EVM chains that do not support the PUSH0 opcode, including zkSync, might not be able to successfully execute the contract.

Tools Used

• SolidityInspector

• Manual code review

Recommendations

It's crucial to consider the target deployment chain's compatibility and select the appropriate Solidity version or adjust the compiler settings to ensure seamless contract deployment. For this reason, it is advisable to downgrade the Solidity version used in the smart contract to 0.8.19 in the contract MerkleAirdrop.sol.