Summary

The Solc compiler version 0.8.20 switches the default target EVM version to Shanghai, which includes the PUSH0 opcode. However, not all blockchain networks support the PUSH0 opcode, which may cause deployment failures on certain networks, particularly Layer 2 (L2) chains. This issue affects several contracts, all of which specify pragma solidity ^0.8.26.

Vulnerability Details

The following contracts include the pragma solidity ^0.8.26 directive, which defaults to the Shanghai EVM version:

• contracts/Nexus.sol (Line 2)

• contracts/base/BaseAccount.sol (Line 2)

• contracts/base/ExecutionHelper.sol (Line 2)

• contracts/base/ModuleManager.sol (Line 2)

• contracts/base/RegistryAdapter.sol (Line 2)

• contracts/base/Storage.sol (Line 2)

• contracts/common/Stakeable.sol (Line 2)

• contracts/factory/BiconomyMetaFactory.sol (Line 2)

• contracts/factory/K1ValidatorFactory.sol (Line 2)

• contracts/factory/NexusAccountFactory.sol (Line 2)

• contracts/factory/RegistryFactory.sol (Line 2)

• contracts/interfaces/IERC4337Account.sol (Line 2)

• contracts/interfaces/IERC7484.sol (Line 2)

• contracts/interfaces/IERC7579Account.sol (Line 2)

• contracts/interfaces/INexus.sol (Line 2)

• contracts/interfaces/INexusEventsAndErrors.sol (Line 2)

• contracts/interfaces/base/IAccountConfig.sol (Line 2)

• contracts/interfaces/base/IBaseAccount.sol (Line 2)

• contracts/interfaces/base/IBaseAccountEventsAndErrors.sol (Line 2)

• contracts/interfaces/base/IExecutionHelper.sol (Line 2)

• contracts/interfaces/base/IExecutionHelperEventsAndErrors.sol (Line 2)

• contracts/interfaces/base/IModuleManager.sol (Line 2)

• contracts/interfaces/base/IModuleManagerEventsAndErrors.sol (Line 2)

• contracts/interfaces/base/IStorage.sol (Line 2)

• contracts/interfaces/common/IStakeable.sol (Line 2)

• contracts/interfaces/factory/INexusFactory.sol (Line 2)

• contracts/interfaces/modules/IExecutor.sol (Line 2)

• contracts/interfaces/modules/IFallback.sol (Line 2)

• contracts/interfaces/modules/IHook.sol (Line 2)

• contracts/interfaces/modules/IModule.sol (Line 2)

• contracts/interfaces/modules/IValidator.sol (Line 2)

• contracts/lib/BootstrapLib.sol (Line 2)

• contracts/lib/BytesLib.sol (Line 2)

• contracts/lib/ExecLib.sol (Line 2)

• contracts/lib/ModuleTypeLib.sol (Line 2)

• contracts/types/Constants.sol (Line 2)

• contracts/types/DataTypes.sol (Line 2)

Impact

Deploying these contracts on chains that do not support the PUSH0 opcode, such as certain Layer 2 (L2) solutions, will result in deployment failures. This can disrupt deployment plans and require recompilation with a different EVM version.

Tools Used

• Manual code review

Recommendations

2. Compatibility Testing:

   • Test the deployment of the contracts on all intended target chains, including L2 chains, to ensure compatibility and identify any issues early in the development process.