Submission Details

#169 Upgradeable contract is missing a gap storage variable

Severity

Low Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-12-stake-link/blob/main/contracts/core/sdlPool/base/SDLPool.sol#L32

https://github.com/Cyfrin/2023-12-stake-link/blob/main/contracts/core/sdlPool/base/SDLPool.sol#L15

Summary

The missing gap storage variable in upgradeable contracts, like in the SDLPool.sol file, is a vulnerability that limits future flexibility and can lead to storage collisions or incompatibilities if the contract is upgraded or extended.

Vulnerability Details

If a contract is extended, a gap storage variable will allow to freely add new state variables in the future, without compromising the storage compatibility with existing deployments.

OpenZeppelin docs.

contract SDLPool is RewardsPoolController, IERC721Upgradeable, IERC721MetadataUpgradeable {  
    IERC20Upgradeable public sdlToken;

Impact

Without gap storage variables, upgrading the contract can lead to storage collisions, which can corrupt the contract's state, lead to loss of data, or make the contract behave unpredictably.

Tools Used

Manual review

Recommendations

Add gap storage

Comments and Activity

Lead Judging Started

0kage Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

storage-gap

Lack of storage gaps in SDLPool might impact storage of SDLPoolPrimary and SDLPoolSecondary if new storage introduced in future.