First Flight #20: The Predicter

Summary

PUSH0 not supported on Arbitrum

Vulnerability Details

The contracts use solidity version 0.8.20, which introduces the PUSH0 opcode. This opcode is not present on Arbitrum. The foundry.toml file doe not specify any evm_version, so the contracts are compiled with the default paris version, which does not generate PUSH0 opcodes, so the contracts are fine in the current state.

Impact

However if the evm_version is changed to shanghai or later, contracts will fail to deploy on Arbitrum due to the PUSH0 opcodes.

Tools Used

Manual review

Recommendations

It is recommended to either roll back the compiler version to 0.8.19 or earlier, or to specify the evm_version=paris in the foundry.toml file, to prevent any mistakes with the evm_version in the future.