Sparkn

Summary

Unstructured Storage Proxies

Vulnerability Details

When you implement proxies, logic and implementation share the same storage layout. In order to avoid storage conflicts EIP1967 was proposed.(https://eips.ethereum.org/EIPS/eip-1967) The idea is to set proxy variables at fixed positions (like impl and admin ).

Impact

Storage collision because of the lack of EIP1967 could cause conflicts and override sensible variables

PoC

For example, according to the standard, the slot for for logic address should be

0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc (obtained as bytes32(uint256(keccak256('eip1967.proxy.implementation')) - 1)).

https://docs.openzeppelin.com/upgrades-plugins/1.x/proxies

section "Unstructured Storaged Proxies"

Tools Used

Manual code review

Recommendations

Consider using EIP1967