GivingThanks

Summary

The use of caret in the pragma statements allows different versions of Solidity to be used to compile the contracts. This can lead to deployment instability, unexpected behavior and compilation issues.

2 Found Instances:

• Found in src/CharityRegistry.sol Line: 2

  pragma solidity ^0.8.0;

• Found in src/GivingThanks.sol Line: 2

  pragma solidity ^0.8.0;

Vulnerability Details

Using a caret version for the pragma statement allows different versions to be used to compile the contracts. Solc compiler version 0.8.20, which is used for the library Openzeppelin, switches the default target EVM version to Shanghai, which means that the generated bytecode will include PUSH0 opcodes. Be sure to select the appropriate EVM version in case you intend to deploy on a chain other than mainnet like L2 chains that may not support PUSH0, otherwise deployment of your contracts will fail.

Slither output:

Impact

Unspecified solidity version can lead to deployment instability, unexpected behavior and compilation issues. It can also lead to deployment issues on chains that do not support PUSH0 which is included in solc version 0.8.20.

Tools Used

Foundry, Slither, Aderyn, manual review

Recommendations

Specify the exact version of Solidity in the pragma statement that is compatible with the codebase and used dependencies. For example, use pragma solidity 0.8.0; instead of pragma solidity ^0.8.0;. Make sure the used solidity version is compatible with the dependencies. Also make sure correct EVM version is selected in case of deployment on L2 chains.