ReseedBean.sol won't work on Zk Sync because of different formula in CREATE2 derivation
Summary
ReseedBean.sol is used to deploy Wells and provide liquidity from OWNER address. Address OWNER is hardcoded.
However ZK Sync uses different formula for address derivation via create2 opcode:
https://docs.zksync.io/build/developer-reference/ethereum-differences/evm-instructions#address-derivation
It means that it's impossible to own hardcoded address of BCM on ZkSync to perform approval to Beanstalk before Reseed.
Vulnerability Details
Here you can see that OWNER is hardcoded in ReseedBean:
https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/beanstalk/init/reseed/L2/ReseedBean.sol#L40
And further in code it's used to initialize proxy owner, and to add liquidity to Well.
Impact
Beanstalk cannot be migrated to ZkSync because ReseedBean doesn't work.
Tools Used
Manual Review
Recommendations
Do not hardcode OWNER address
Lead Judging Commences
Informational/Gas
Invalid as per docs https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.