Submission Details
Severity:
contract don't follow EIP-7201 standard
Summary
contract don't follow EIP-7201 standard
Vulnerability Details
The formula identified by erc7201 is defined as erc7201(id: string) = keccak256(keccak256(id) - 1) & ~0xff.
but the contract use
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant ASSET_SWAP_STRATEGY_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.AssetSwapPath")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant COLLATERAL_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.Collateral")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant CREDIT_DELEGATION_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.CreditDelegation")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant DEX_SWAP_STRATEGY_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.DexSwapStrategy")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant DEX_SWAP_STRATEGY_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.DexSwapStrategy")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant MARKET_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.Market")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant MARKET_MAKING_ENGINE_CONFIGURATION_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.MarketMakingEngineConfiguration")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant SWAP_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.Swap")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant USD_TOKEN_SWAP_CONFIG_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.UsdTokenSwapConfig")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant VAULT_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.Vault")) - 1));
/// @notice ERC7201 storage location. //@audit Incorrect ERC-7201 storage location
bytes32 internal constant WITHDRAWAL_REQUEST_LOCATION =
keccak256(abi.encode(uint256(keccak256("fi.zaros.market-making.WithdrawalRequest")) - 1));
Tools Used
Manual review
Recommendations
It is recommended to follow the convention set in this EIP .
Updates
Lead Judging Commences
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
ERC7201 implemented incorrectly
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.