CallbackLib#validateCallback() - address computation will not work on zkSync

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-11-panoptic/blob/2647928c33be4a58883110befd7fd065448478ef/contracts/libraries/CallbackLib.sol#L28-L51

Vulnerability details

Impact

The SFPM contract has several callback functions in place when dealing with UniswapV3 callbacks.
It uses the CallbackLib to verify that the message sender came from a real Uniswap pool. The address calculated by that library would be wrong on zkSync due to it having a different address deviation.

Proof of Concept

On ZkSync Era the create2 addresses are not computed the same way see here: https://era.zksync.io/docs/reference/architecture/differences-with-ethereum.html#create-create2
Thus the protocol becomes unusable in the context of ZK.

Impact is high due to the contract being completely unavailable on an EVM-compatible chain thus going against the repo README.
Likelihood is Med/Low, since ZK integrations are always tricky and this would probably be noticed.
Thus, medium severity.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider past solutions to the given problem:
https://solodit.xyz/issues/m-6-computepooladdress-will-not-work-on-zksync-era-sherlock-real-wagmi-2-git
sherlock-audit/2023-10-real-wagmi-judging#85
TL;DR - refactor the function or use a uniswap specific function for address retrieval

Assessed type

Context

[c4-judge]

Picodes marked the issue as duplicate of #182

[c4-judge]

Picodes changed the severity to QA (Quality Assurance)