Solidity compiler version 0.8.13 contains vulnerabilities applicable to EtherFi

[hats-bug-reporter[bot]]

Github username: @0xfuje Submission hash (on-chain): 0x8a56dce519b226f5a3c93538eeb51ec4f8dc135ea004a4f43247343252fb14ca Severity: medium

Description:

Description

The project uses solidity version 0.8.13 which contains bugs not yet fixed compared to a newer compiler version. The following bugs are mitigated in 0.8.14 & 0.8.15 release:

• Bug when Copying Dirty Bytes Arrays to Storage
• Size Check Bug in Nested Calldata Array ABI-Reencoding
• Bug Concerning Data Location during Inheritance

However the most important one is the optimizer bug that can have severe consequences via removing assembly blocks:

• Optimizer Bug Regarding Memory Side Effects of Inline Assembly

  which only occur under specific conditions: optimizer must be enabled and use legacy compilation instead of --via-ir which are true for the current configuration of the project:

foundry.toml

1: [profile.default]
7: optimizer_runs = 2000

The following contracts compiled with 0.8.13 contain assembly blocks that might be vulnerable. Any newly introduced assembly blocks here are at risk of being removed by the compiler.

• src/EtherFiNode.sol
• src/RegulationManagerV2.sol
• src/StakingManager.sol

It's worth to mention the project also has dependencies that use assembly blocks which might be vulnerable as well. Read the official disclosure by Certora: Overly Optimistic Optimizer.

Recommendation

Consider using a more up to date solidity compiler version instead of 0.8.13. In the future be mindful about compiler bugs, it's a good practice to read Solidity release announcements which highlight the previous bugs in older compiler versions.

[seongyun-ko]

not specific attack vector against ether.fi is discussed

[seongyun-ko]

From our dev team, "Our one instance of using mstore within an assembly block refers to existing solidity variables and therefore should not be removed by the compiler as described https://medium.com/certora/overly-optimistic-optimizer-certora-bug-disclosure-2101e3f7994d"