SNARKeling Treasure Hunt

First Flight #59
Beginner FriendlyGameFiFoundry
100 EXP
Submission Details
Impact: low
Likelihood: low

Potential deployment incompatibility due to PUSH0 opcode usage on non-Shanghai EVM chains

Author Revealed upon completion

Potential deployment incompatibility due to PUSH0 opcode usage on non-Shanghai EVM chains

Description

  • The project is compiled using Solidity ^0.8.27. Starting from Solidity 0.8.20, the compiler emits the PUSH0 opcode when targeting EVM versions at or above Shanghai. The default EVM target in modern toolchains (including Foundry and solc ≥0.8.20) is Shanghai unless explicitly overridden via build configuration.

  • Bytecode for this contract include the PUSH0 opcode. If the contract is deployed to an EVM-compatible chain that does not support PUSH0, deployment can fail during contract creation due to unsupported opcode execution. This is only a compilation / deployment environment compatibility concern.

// No specific code root cause — this is a compiler/toolchain configuration issue.
// The PUSH0 opcode is emitted by solc >=0.8.20 when the EVM target is Shanghai or later.
// Verified via:
// forge build
// forge inspect TreasureHunt bytecode
// cast disassemble <bytecode> // @> PUSH0 appearances confirm Shanghai-compatible codegen

Risk

Likelihood:

  • The default EVM target in modern toolchains (including Foundry and solc ≥0.8.20) is Shanghai unless explicitly overridden, meaning any deployment to a non-Shanghai-compatible network will encounter this issue without deliberate configuration changes.

  • Multi-chain deployments that include legacy or non-Shanghai-compatible EVM networks will trigger this incompatibility on every such network where the compiled bytecode is used.

Impact:

  • The contract may fail to deploy on legacy or non-Shanghai-compatible EVM networks, resulting in deployment-level incompatibility.

  • Contract deployment is prevented entirely in affected environments, with no runtime fallback or graceful degradation possible.

Proof of Concept

// 1. Compile the contract:
forge build
// 2. Inspect the deployed bytecode:
forge inspect TreasureHunt bytecode
// 3. Disassemble the bytecode:
cast disassemble <bytecode>
// 4. The disassembled output includes appearances of the PUSH0 opcode, confirming
// that the bytecode is generated under Shanghai-compatible EVM rules.
// 5. This implies that deployment requires an EVM environment that supports Shanghai
// opcodes; otherwise, contract creation may fail.

Recommended Mitigation

Explicitly define the target EVM version in the project's build configuration (e.g., foundry.toml) to match the intended deployment environment. For multi-chain deployments, maintain separate build profiles or ensure all target networks support the minimum required EVM version (Shanghai or later) before deploying contracts compiled with modern Solidity versions.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!