Calculation of storage slot for proxies

I see that in OZ contracts when calculating the storage slots for proxies it's subtracted by 1, to prevent preimage attacks from attacker, because the slot is known. Also i read some reports from Spearbit team for the same issue, but not describing the attack path detailly. How is that kind of attack possible? Can someone explain in more details?

1 Like