Summary
Protocol uses namespaces storages but is not fully compliant with EIP-7201 since not all namespaces follows the standard specifications.
Vulnerability Details
As per EIP-7201 documentation protocols implementing this EIP should follow this expression:
keccak256(abi.encode(uint256(keccak256(bytes(id))) - 1)) & ~bytes32(uint256(0xff))
The problem is not all protocol's leaves implements this expression correctly:
/// @notice ERC7201 storage location.
bytes32 internal constant ASSET_SWAP_STRATEGY_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.AssetSwapPath")) - 1));
bytes32 internal constant COLLATERAL_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.Collateral")) - 1));
bytes32 internal constant CREDIT_DELEGATION_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.CreditDelegation")) - 1));
bytes32 internal constant DEX_SWAP_STRATEGY_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.DexSwapStrategy")) - 1));
bytes32 internal constant MARKET_FEE_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.LiveMarkets")) - 1));
bytes32 internal constant MARKET_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.Market")) - 1));
bytes32 internal constant MARKET_MAKING_ENGINE_CONFIGURATION_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.MarketMakingEngineConfiguration")) - 1));
bytes32 internal constant SWAP_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.Swap")) - 1));
bytes32 internal constant USD_TOKEN_SWAP_CONFIG_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.UsdTokenSwapConfig")) - 1));
bytes32 internal constant VAULT_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.Vault")) - 1));
bytes32 internal constant WITHDRAWAL_REQUEST_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.WithdrawalRequest")) - 1));
In all these examples & ~bytes32(uint256(0xff)) is missing from namespace expression.
If one of these leaves is upgraded to an implementation that follows EIP-7201 rules, the new implementation will acces wrong storage slots loosing access to old implementation data.
Impact
The protocol is not fully compliant with EIP-7201 which may lead to problems in future possible upgrades.
Tools Used
Recommendations
Make sure all leaves implements correctly EIP-7201 formula.
