Era

Summary

The forceSload function alters the AccountInfo settings of the target contract, even though its intended purpose is only to read storage from contracts that lack getters, without modifying any state.

Vulnerability Details

The SloadContract contract is used by system contracts to read storage from other contracts that do not provide getters. The process involves first force-deploying the SloadContract to the target address, reading the required storage, and then force-deploying the original contract back to the target address.

https://github.com/Cyfrin/2024-10-zksync/blob/main/era-contracts/system-contracts/contracts/libraries/SystemContractHelper.sol#L463-L465
https://github.com/Cyfrin/2024-10-zksync/blob/main/era-contracts/system-contracts/contracts/libraries/SystemContractHelper.sol#L411
https://github.com/Cyfrin/2024-10-zksync/blob/main/era-contracts/system-contracts/contracts/SloadContract.sol#L10

The goal of this function is to read storage that is not accessible via getters. However, because it involves force deployment, the AccountInfo settings (such as AccountAbstractionVersion and AccountNonceOrdering) are overwritten with default values of AccountAbstractionVersion.None and AccountNonceOrdering.Sequential.
https://github.com/Cyfrin/2024-10-zksync/blob/main/era-contracts/system-contracts/contracts/ContractDeployer.sol#L229
https://github.com/Cyfrin/2024-10-zksync/blob/main/era-contracts/system-contracts/contracts/ContractDeployer.sol#L210-L214

This behavior means that if a contract originally has AccountNonceOrdering set to Arbitrary, using SloadContract by system contracts to read its storage will unexpectedly change its AccountNonceOrdering to Sequential. Note that the AccountNonceOrdering can only be changed from Sequential to Arbitrary, not the other way around. This could lead to unintended consequences.
https://github.com/Cyfrin/2024-10-zksync/blob/main/era-contracts/system-contracts/contracts/ContractDeployer.sol#L75

Impact

Using SloadContract by system contracts to read storage from a contract should not alter any state. However, this process unexpectedly changes the AccountInfo settings, which could significantly impact the target contract's functionality.

Tools Used

Recommendations

To avoid changing the AccountInfo settings when using forcedSload, the forceDeployOnAddresses function should be modified to preserve the original AccountInfo configuration of the target contract.