Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

[M-4] Shared Storage Slot Risks Data Corruption in `RootProxy` Contract

0xsnoweth

Summary

Insecure storage slot allocation in RootUpgrade library allows cross-contract data collisions.

Vulnerability Details

Affected Code:

library RootUpgrade {
struct Data { ... }
function load() internal returns (Data storage s) {
bytes32 slot = keccak256("RootUpgrade");
assembly { s.slot := slot }
}
}

Proof of Concept:

// Attacker Contract
contract StorageAttacker {
// Same storage slot
bytes32 constant public slot = keccak256("RootUpgrade");
function corruptData() public {
assembly {
sstore(slot, 0xBAD1BAD1)
}
}
}
​
// Foundry Test
function test_storageCollision() public {
StorageAttacker attacker = new StorageAttacker();
attacker.corruptData();
RootUpgrade.Data storage ug = RootUpgrade.load();
assertEq(ug.selectorToBranch[0xdeadbeef], 0); // Fails with 0xBAD1BAD1
}

Exploit Validation:

Run test: forge test --match-test test_storageCollision

Result: Test fails due to corrupted storage

Impact

Branch Mapping Corruption: Protocol-wide malfunction

Severity: Medium (CVSS 5.3)

Tools Used

Storage layout analyzer

Foundry storage manipulation

Recommendations

// Use unique diamond storage slot
bytes32 constant ROOT_UPGRADE_STORAGE =
keccak256("com.zaros.protocol.rootupgrade.v1");
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.