Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use EIP-7201 to define storage slots #166

Open
ItsNickBarry opened this issue Nov 17, 2022 · 3 comments · May be fixed by #236
Open

Use EIP-7201 to define storage slots #166

ItsNickBarry opened this issue Nov 17, 2022 · 3 comments · May be fixed by #236

Comments

@ItsNickBarry
Copy link
Member

This EIP uses keccak256 to generate storage slots, and subtracts 1 from the result to avoid preimage attacks. This works for the EIP because it uses only single-slot storage values, but not for SolidState because many of the storage layout structs are multi-slot.

Should try to address this? It's not entirely clear what such a preimage attack would look like. If such an attack can be demonstrated, I would suggest using bitwise-not rather than subtraction of 1 to obscure the SolidState storage slots.

@ItsNickBarry
Copy link
Member Author

ItsNickBarry commented Dec 10, 2022

As discussed on Discord (https://discord.com/channels/969993840318611476/1040352410087985182/1042896740975652945), I found a theoretical attack vector, but it would rely on the inclusion of ASCII control codes in a storage layout string. This seems unlikely to cause any issues.

@ItsNickBarry
Copy link
Member Author

Proof of concept of the attack vector is here: https://github.com/solidstate-network/diamond-storage-preimage-attack/

@ItsNickBarry
Copy link
Member Author

Implementing EIP-7201 would solve this.

@ItsNickBarry ItsNickBarry changed the title Improve security of storage slot generation Use EIP-7201 to define storage slots Jan 28, 2024
This was referenced Jan 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant