Repository: shazow/whatsabi
Pull request #179 (2025-05-01 16:18:16)

proxies: Detect EIP1967 that does -1 at runtime


Patch:
diff --git a/src/internal/debug.ts b/src/internal/debug.ts
index 1b10d5b..d4dcafb 100644
--- a/src/internal/debug.ts
+++ b/src/internal/debug.ts
@@ -11,7 +11,8 @@ export function BytecodeIterString(code : BytecodeIter): string {
     const step = code.step();
     const pos = code.pos();
     let hexpos = bytesToHex(pos);
-    if (hexpos.length < hexpads.length) hexpos = hexpads.slice(0, hexpos.length - hexpads.length) + hexpos.slice(2);
+    // Always pad to 4 sigfigs at least, excluding 0x prefix
+    hexpos = "0x" + hexpos.slice(2).padStart(4, "0");
     const inst = code.at(pos);
     const value = isPush(inst) ? bytesToHex(code.valueAt(pos)) : "";
     const name = mnemonics[inst] || bytesToHex(inst);
diff --git a/src/proxies.ts b/src/proxies.ts
index 2f74430..35786a3 100644
--- a/src/proxies.ts
+++ b/src/proxies.ts
@@ -346,4 +346,7 @@ export const slotResolvers : Record<string, ProxyResolver> = {
     // Not sure why, there's a compiler optimization that adds 2 to the normal slot?
     // Would love to understand this, if people have ideas
     ["0xc8fcad8db84d3cc18b4c41d551ea0ee66dd599cde068d998e57d5e09332c131d"]: new DiamondProxyResolver("DiamondProxy"),
+
+    // Off-by-one slot version of EIP1967, some examples in the wild who choose to do the -1 at runtime (See issue #178)
+    ["0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbd"]: new EIP1967ProxyResolver("EIP1967Proxy"),
 };


Test patch:
diff --git a/src/__tests__/edges.test.ts b/src/__tests__/edges.test.ts
index 8baec0c..bcbd070 100644
--- a/src/__tests__/edges.test.ts
+++ b/src/__tests__/edges.test.ts
@@ -109,6 +109,15 @@ test('issue 171: immutable EIP1967 proxy', () => {
   expect(r.proxies[0].name).toEqual("EIP1967Proxy");
 });
 
+test('issue 178: EIP1967 off-by-one', () => {
+  // https://github.com/shazow/whatsabi/issues/178
+  // bytecode from https://basescan.org/address/0xfe742fa2a84294e8316f05b17c05090fc68b5105
+  const createCode = "0x60806040526004361061004a5760003560e01c80633659cfe6146100545780634f1ef286146100745780635c60da1b14610087578063d1f57894146100b8578063f851a440146100cb575b6100526100e0565b005b34801561006057600080fd5b5061005261006f36600461053e565b610108565b610052610082366004610560565b61014c565b34801561009357600080fd5b5061009c610202565b6040516001600160a01b03909116815260200160405180910390f35b6100526100c63660046105f9565b610253565b3480156100d757600080fd5b5061009c610341565b6100e8610398565b6101066101016000805160206107388339815191525490565b6103a0565b565b6001600160a01b037f0000000000000000000000005731a04b1e775f0fdd454bf70f3335886e9a96be16330361014457610141816103c4565b50565b6101416100e0565b6001600160a01b037f0000000000000000000000005731a04b1e775f0fdd454bf70f3335886e9a96be1633036101f557610185836103c4565b6000836001600160a01b031683836040516101a19291906106bb565b600060405180830381855af49150503d80600081146101dc576040519150601f19603f3d011682016040523d82523d6000602084013e6101e1565b606091505b50509050806101ef57600080fd5b50505050565b6101fd6100e0565b505050565b60006001600160a01b037f0000000000000000000000005731a04b1e775f0fdd454bf70f3335886e9a96be16330361024857506000805160206107388339815191525490565b6102506100e0565b90565b600061026b6000805160206107388339815191525490565b6001600160a01b03161461027e57600080fd5b6102a960017f360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbd6106cb565b600080516020610738833981519152146102c5576102c56106f2565b6102ce82610404565b80511561033d576000826001600160a01b0316826040516102ef9190610708565b600060405180830381855af49150503d806000811461032a576040519150601f19603f3d011682016040523d82523d6000602084013e61032f565b606091505b50509050806101fd57600080fd5b5050565b60006001600160a01b037f0000000000000000000000005731a04b1e775f0fdd454bf70f3335886e9a96be16330361024857507f0000000000000000000000005731a04b1e775f0fdd454bf70f3335886e9a96be90565b61010661048f565b3660008037600080366000845af43d6000803e8080156103bf573d6000f35b3d6000fd5b6103cd81610404565b6040516001600160a01b038216907fbc7cd75a20ee27fd9adebab32041f755214dbc6bffa90cc0225b39da2e5c2d3b90600090a250565b803b61047d5760405162461bcd60e51b815260206004820152603b60248201527f43616e6e6f742073657420612070726f787920696d706c656d656e746174696f60448201527f6e20746f2061206e6f6e2d636f6e74726163742061646472657373000000000060648201526084015b60405180910390fd5b60008051602061073883398151915255565b6001600160a01b037f0000000000000000000000005731a04b1e775f0fdd454bf70f3335886e9a96be1633036101065760405162461bcd60e51b815260206004820152603260248201527f43616e6e6f742063616c6c2066616c6c6261636b2066756e6374696f6e20667260448201527137b6903a343290383937bc3c9030b236b4b760711b6064820152608401610474565b80356001600160a01b038116811461053957600080fd5b919050565b60006020828403121561055057600080fd5b61055982610522565b9392505050565b60008060006040848603121561057557600080fd5b61057e84610522565b9250602084013567ffffffffffffffff8082111561059b57600080fd5b818601915086601f8301126105af57600080fd5b8135818111156105be57600080fd5b8760208285010111156105d057600080fd5b6020830194508093505050509250925092565b634e487b7160e01b600052604160045260246000fd5b6000806040838503121561060c57600080fd5b61061583610522565b9150602083013567ffffffffffffffff8082111561063257600080fd5b818501915085601f83011261064657600080fd5b813581811115610658576106586105e3565b604051601f8201601f19908116603f01168101908382118183101715610680576106806105e3565b8160405282815288602084870101111561069957600080fd5b8260208601602083013760006020848301015280955050505050509250929050565b8183823760009101908152919050565b818103818111156106ec57634e487b7160e01b600052601160045260246000fd5b92915050565b634e487b7160e01b600052600160045260246000fd5b6000825160005b81811015610729576020818601810151858301520161070f565b50600092019182525091905056fe360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbca26469706673582212203afa1b8aed7b7ea806f127a3328a650ea6fea862aa0b9edcdd49a3aeab8c328b64736f6c63430008130033";
+  const r = disasm(createCode);
+  expect(r.proxies.length).toBeGreaterThan(0);
+  expect(r.proxies[0].name).toEqual("EIP1967Proxy");
+});
+
 // Addresses with false positive zero selectors:
 // 0x99aa182ed0e2b6c47132e95686d2c73cdeff307f
 // 0xb1116d0a09f06d3e22a264c0c233d80e93abec10