The assignment of immutable variables in the constructor is affected by the subsequent bytecode

[slendermaan]

Description

The assignment of Immutable Variable in the constructor function may be incorrectly assigned under the influence of subsequent inline assembly code (for example msotre).

Environment

• Compiler version:
• Target EVM version (as per compiler settings): <=0.8.19
• Framework/IDE (e.g. Truffle or Remix): Remix
• EVM execution environment / backend / blockchain client: EVM execution environment
• Operating system: Windows

Steps to Reproduce

The expected behavior of the following code is that a is 0x4B20993Bc481177ec7E8f571, but is eventually assigned the value msg.sender.

pragma solidity ^0.8.19;
contract C {
    address public immutable a;
    constructor() public {
        a = 0x4B20993Bc481177ec7E8f571ceCaE8A9e22C02db;
        F(msg.sender);
    }
    function F(address witnessAddress) view public returns(address){
        assembly{
            mstore(0x80,witnessAddress)
        }
        return a;
    }
}

Reasons

The reason for the above problem is that, unlike other source code compilation results, the assignment of an immutable -variable is first mstore in the memory area starting at 0x80, and then mload is used to save the variable to the stack area after the constructor’s user code is executed, and mstore is executed again after codecopy to modify the bytecode content.
This means that the code after the immutable-variable assignment may still affect its execution logic. For example, mstore.

Impact

Through the collection of open-source projects, we can easily find a large number of functions that use the mstore operation.
For example, the following code snippet

function initialize() internal view {
       ...
        assembly {
            ...
            mstore(0x80, sload(0))

This means that mstore operations are common, and we need to be wary of such operations being called in constructors that have immutable variables.

Fix

We suggest giving some warning about the above problem in the compilation result to warning users of the above risk.

[slendermaan]

I also reported the problem through the bug bounty channel

[slendermaan]

@cameel