Submission Details
Severity:
getProxyAddress doesn’t validate implementation against salt
Summary
If a backend doesn’t send the right implementation contract address this may result in loss of funds.
Vulnerability Details
The function below doesn't validate that the same implementation was used for salt:
function getProxyAddress(bytes32 salt, address implementation) public view returns (address proxy) {
bytes memory code = abi.encodePacked(type(Proxy).creationCode, uint256(uint160(implementation)));
bytes32 hash = keccak256(abi.encodePacked(bytes1(0xff), address(this), salt, keccak256(code)));
proxy = address(uint160(uint256(hash)));
}
If there's an implementation upgrade and backend sends a wrong implementation contract this will result in loss of funds for organizer
Impact
Possible loss funds for sponsor
Tools Used
Recommendations
No easy way to fix with the current implementation that I can think of
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.