Tadle

Summary

The deployUpgradeableProxy function in TadleFactory.sol will not function properly on the zkSync chain. Since the protocol explicitly mentions that it will be deployed on all EVM-compatible chains, zkSync has differences in the usage of the create and create2 opcodes compared to the standard EVM.

Vulnerability Details

Location: TadleFactory.sol

Description:

The deployUpgradeableProxy function is designed to deploy upgradeable proxy contracts. This function relies on the standard EVM behavior of the create opcode, which has known differences in the zkSync chain. Specifically, the zkSync documentation highlights that the create opcode cannot be used for arbitrary code unknown to the compiler, which affects the functionality of dynamic contract creation methods.

Proof of Concept

Root Cause:

The function does not account for the differences in the create and create2 opcodes on zkSync, leading to potential deployment failures.

Supporting Evidence:

• zkSync Era documentation on CREATE and CREATE2: zkSync Docs

Impact

Medium: This issue can lead to a Denial of Service (DoS) since no instances can be created on zkSync.

Tools Used

• Manual Review

Recommendations

Use create2 Opcode Directly: Modify the deployment logic to use the create2 opcode directly or explore alternative methods recommended by the zkSync documentation to ensure compatibility.