Submission Details
Severity:
Incorrect ERC7201 Storage Slot Calculation
Summary
Custom storage slot implementation risks collisions during upgrades.
Vulnerability Details
Files:
FeeConversionKeeper.sol(Lines 15-17)UsdTokenSwapKeeper.sol(Lines 14-16)
bytes32 internal constant FEE_CONVERSION_KEEPER_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros...")) - 1)) & ~bytes32(uint256(0xff));
The -1 offset and bitmask application deviate from ERC7201 specifications, creating potential storage layout conflicts.
Impact
Storage Corruption: Upgrade implementations may overwrite critical data
Permanent Loss: Could brick protocol functionality
Severity: High
Tools Used
Storage layout analysis via
solc --storage-layoutERC7201 specification review
Recommendations
Use OpenZeppelin's standardized implementation:
import "@openzeppelin/contracts/utils/StorageSlot.sol";
StorageSlot.getAddressSlot(
keccak256("fi.zaros.keepers.FeeConversionKeeper")
).value = newValue;
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
ERC7201 implemented incorrectly
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.