NFTBridge
60,000 USDC
View results
Submission Details
Severity: low
Invalid

No custom errors are defined in Solidity version between 0.8.0 and 0.8.3 (inclusive).

Description

Starting from Solidity 0.8.4, custom structured errors were introduced to provide a more efficient way of error handling by using the error statement. For example:

error NotSupportedYetError();
error CollectionMappingError();
error NotWhiteListedError();
error BridgeNotEnabledError();
error TooManyTokensError();

However, some contracts in scope (e.g. Bridge.sol, Escrow.sol, Messaging.sol, State.sol, UUPSProxied.sol, IStarklaneEvent.sol, IStarklane.sol, etc.) are using a floating Solidity compiler version specified as pragma solidity ^0.8.0;. This allows the contract to be compiled with versions ranging from 0.8.0 to any later version within the same major version, up to but not including 0.9.0. The use of the floating pragma is a known issue that was discovered by LightChaser and is not the subject of this issue.

If the contracts are compiled with a Solidity version between 0.8.0 and 0.8.3 (inclusive), they will not support custom errors, as this feature was introduced only in version 0.8.4^[https://soliditylang.org/blog/2021/04/21/custom-errors/]. This situation could lead to issues where custom errors are not recognized, resulting in compilation errors.

Impact

If the contracts are compiled using a version of Solidity that is older than 0.8.4, any attempt to use custom errors will result in compilation errors. This could prevent the deployment or successful compilation of the contracts, leading to development delays.

Tools Used

Manual review, vscode

Recommended Mitigation

It is recommended to use a battle-tested specific version of Solidity, e.g. 0.8.19. For this, all contacts that use floating Solidity versions should be refactored to use a fixed Solidity version:

- pragma solidity ^0.8.0;
+ pragma solidity 0.8.19;
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.