Submission Details

#169 Upgradeable contract is missing a gap storage variable


Low Risk

Relevant GitHub Links


The missing gap storage variable in upgradeable contracts, like in the SDLPool.sol file, is a vulnerability that limits future flexibility and can lead to storage collisions or incompatibilities if the contract is upgraded or extended.

Vulnerability Details

If a contract is extended, a gap storage variable will allow to freely add new state variables in the future, without compromising the storage compatibility with existing deployments.

OpenZeppelin docs.

contract SDLPool is RewardsPoolController, IERC721Upgradeable, IERC721MetadataUpgradeable {  
    IERC20Upgradeable public sdlToken;


Without gap storage variables, upgrading the contract can lead to storage collisions, which can corrupt the contract's state, lead to loss of data, or make the contract behave unpredictably.

Tools Used

Manual review


Add gap storage

Comments and Activity

Lead Judging Started

0kage Lead Judge 4 months ago
Submission Judgement Published
Assigned finding tags:


Lack of storage gaps in SDLPool might impact storage of SDLPoolPrimary and SDLPoolSecondary if new storage introduced in future.