Eggstravaganza

Summary

The Solidity pragma directive is too wide, which can lead to inconsistencies in compiler behaviour across different environments.

Vulnerability Details

The codebase specifies a broad Solidity version range, allowing unintended compiler upgrades. This can result in discrepancies due to optimiser changes, new warnings, or security fixes introduced in newer versions.

A wide pragma such as:

Permits compilation with any Solidity version greater than or equal to 0.8.23, potentially introducing unintended behaviour. This breaks the security guarantee of deterministic contract execution, as different compiler versions might generate slightly different bytecode.

3 Found Instances:

• Found in src/EggHuntGame.sol [Line: 2]

• Found in src/Eggstravaganza.sol [Line: 2]

• Found in src/EggVault.sol [Line: 2]

Impact

Subtle changes in compiler behaviour may cause unexpected issues, leading to potential vulnerabilities.

Tools Used

Manual review and Aderyn.

Recommendations

1. Specify an exact compiler version to ensure consistent behaviour across different deployments. Update the pragma statement to:

This ensures that the contract always compiles with a known, tested compiler version, reducing the risk of unintended side effects from future compiler updates.

2. Using an Importable Solidity File

Define a common Solidity version pragma in a separate file and import it into all your contracts.

Example:

Create a file named Pragma.sol:

This ensures that all contracts use the same Solidity version.

3. Using Foundry Configurations

Use Foundry to specify the Solidity version in the project configuration:

Foundry (foundry.toml)

With this approach, even if individual Solidity files contain a broader pragma (e.g., ^0.8.23), the compiler will always use the specified version.

4. CI/CD Version Enforcement

For large teams or decentralised development, enforce a single Solidity version using Continuous Integration (CI) pipelines:

Run grep -rnw 'src' -e 'pragma solidity' --include \*.sol in the terminal to check for Solidity version inconsistency.

Reject builds if an incorrect Solidity version is used.