Summary

The Diamond Proxy makes use of the diamond storage pattern to track the facets and selectors in use. This is achieved through a DiamondStorage struct that contains the relevant facet and selector information. Because of the proxy setup, this struct is placed in an unstructured-storage-manner at a pseudo random storage slot calculated by hashing a hardcoded string.

Vulnerability Details

In the event of introducing a dynamic slot calculation using hashing, the DiamondStorage storage slot could be specifically addressed to force a collision using the known input bytes from above.

Impact

Slot collision, if malicious, could result in loss of funds or DOS.

Tools Used

Manual review
Checking Solodit

Recommendations

To prevent this pre-image hash collision, consider applying a -1 offset to the hash.