When getting values from a storage slot by slot index (GatewayVM::getStorage), EthVerifierHooks::verifyStorageValue assumes the value of the slot could be less than 32 bytes, and will left-pad 0s if the value is less than 32 bytes.
https://github.com/code-423n4/2024-12-unruggable/blob/9e0e908a207f088dd843fcdc3e4de5fa0edd6c5c/contracts/eth/EthVerifierHooks.sol#L40
In bytes32FromRLP, we can confirm the left-padding and right-alignment when bytes length is less than 32.
https://github.com/code-423n4/2024-12-unruggable/blob/9e0e908a207f088dd843fcdc3e4de5fa0edd6c5c/contracts/RLPReaderExt.sol#L13
This is vulnerable because (1) raw storage value in storage trie should be 32 bytes long even when empty; (2) if in any case, the proofs decoded value of a storage slot is less than 32 bytes this is likely due to an error or exploit with an invalid proof, the tx should be reverted instead of left-padding.
Consider using RLPReaderExt.strictBytes32FromRLP.
