Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

ERC-7201 is not followed in Referral & CustomReferralConfiguration

0xleadwizard

Description

The EIP-7201 is followed in these contracts:

  1. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/GlobalConfiguration.sol#L17-L19

  2. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/MarginCollateralConfiguration.sol#L16-L18

  3. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/MarketOrder.sol#L12-L13

  4. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/PerpMarket.sol#L36-L37

  5. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/Position.sol#L11-L12

  6. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/SettlementConfiguration.sol#L23-L25

  7. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/TradingAccount.sol#L36-L37

But not in:

  1. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/CustomReferralConfiguration.sol#L5

  2. https://github.com/Cyfrin/2024-07-zaros/blob/main/src/perpetuals/leaves/Referral.sol#L8

Recommendation

❌ string internal constant REFERRAL_DOMAIN = "fi.zaros.Referral";
✅ bytes32 internal constant REFERRAL_DOMAIN_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.Referral")) - 1)) & ~bytes32(uint256(0xff));
​
​
❌ string internal constant CUSTOM_REFERRAL_CONFIGURATION_DOMAIN = "fi.zaros.CustomReferralConfiguration";
✅ bytes32 internal constant CUSTOM_REFERRAL_CONFIGURATION_DOMAIN_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.CustomReferralConfiguration")) - 1)) & ~bytes32(uint256(0xff));

Then the load function should be modified based on the new changes.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Storage computation formula of ERC7201 is not followed. ERC7201 non compliance.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.