Tadle

Summary

Current solidity settings ^0.8.13 may produce incompatible bytecode with some of the EVM chains (Ethereum, Polygon, Avalanche, BNB, Optimism, Arbitrum) supported by the protocol.

Vulnerability Details

The document stated that the Smart Contract protocol have Compatibilities with (Blockchains: Ethereum/Any EVM ) and The current codebase has Solidity version ^0.8.13, that could be compiled with Solidity version 0.8.24, which includes the PUSH0 opcode in the compiled bytecode.

We don't know how devs will compile the codebase, but it could be Shanghai , or by compiling with the flag --evm-version shanghai, for example, the PUSH0 opcode will be introduced.

Impact

Deploying the protocol on EVM (Optimism, Arbitrum .. ) with the current Solidity version (^0.8.13) may result in unexpected behavior or failure due to the unsupported PUSH0 opcode., if the dev compile with flag --evm-version shanghai (or default one)

Tools Used

Manual Review

Recommendations

you may consider to changing version 0.8.13 instead of ^0.8.13, to be sure to compile the source code with 0.8.13 Solidity version for all EVM