Outdated CURRENT_MAX_PRECOMPILE_ADDRESS

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-zksync/blob/main/code/system-contracts/contracts/Constants.sol#L35

Vulnerability details

Impact

The Constants contract defines a CURRENT_MAX_PRECOMPILE_ADDRESS constant that should be set to the max precompile address.

address constant ECRECOVER_SYSTEM_CONTRACT = address(0x01);
address constant SHA256_SYSTEM_CONTRACT = address(0x02);
address constant ECADD_SYSTEM_CONTRACT = address(0x06);
address constant ECMUL_SYSTEM_CONTRACT = address(0x07);
 
/// @dev The current maximum deployed precompile address.
/// Note: currently only two precompiles are deployed:
/// 0x01 - ecrecover
/// 0x02 - sha256
/// Important! So the constant should be updated if more precompiles are deployed.
uint256 constant CURRENT_MAX_PRECOMPILE_ADDRESS = uint256(uint160(SHA256_SYSTEM_CONTRACT));

The max precompile address is ECMUL_SYSTEM_CONTRACT = address(0x07) but it is set to SHA256_SYSTEM_CONTRACT = address(0x02) instead. There is even a comment that it is "Important" to update this value.

/// Important! So the constant should be updated if more precompiles are deployed.

Code that relies on this address to be accurate does not work correctly. For example, the AccountCodeStorage.getCodeHash function should return the EMPTY_STRING_KECCAK = 0xc5... code hash for ECADD_SYSTEM_CONTRACT and ECMUL_SYSTEM_CONTRACT but returns bytes32(0) instead.

address account = address(uint160(_input));
if (uint160(account) <= CURRENT_MAX_PRECOMPILE_ADDRESS) {
    return EMPTY_STRING_KECCAK;
}

Proof of Concept

https://github.com/code-423n4/2023-10-zksync/blob/main/code/system-contracts/contracts/Constants.sol#L35
https://github.com/code-423n4/2023-10-zksync/blob/main/code/system-contracts/contracts/AccountCodeStorage.sol#93

Tools Used

Manual

Recommended Mitigation Steps

Consider changing this line:

- uint256 constant CURRENT_MAX_PRECOMPILE_ADDRESS = uint256(uint160(SHA256_SYSTEM_CONTRACT));
+ uint256 constant CURRENT_MAX_PRECOMPILE_ADDRESS = uint256(uint160(ECMUL_SYSTEM_CONTRACT));

Assessed type

Error

[c4-pre-sort]

bytes032 marked the issue as duplicate of #142

[c4-pre-sort]

bytes032 marked the issue as sufficient quality report

[c4-judge]

GalloDaSballo marked the issue as satisfactory