Sparkn

Vulnerability Details

Looking at the mechanism of storing the implementation address in a proxy contract,
We can infer two things:

• It is a non-standard method

• vulnerable to being overwritten by the logic( implementation ) contract.

Although the current implementation of the Distributor contract uses immutables and constants to store additional data inside the logic contract, in the future if there is a need to add some non-constant data inside the logic contract, this might cause an issue

Impact

The implementation address can be overwritten by the logic contract inside the proxy's storage and the contest will be lost along with its associated tokens which will incur a loss to users and protocol.

Tools Used

Manual review

Recommendations

We should use a standard method of storing the implementation address at a storage slot that is very random and there are negligible chances of it being overwritten.

here is the standard calculation by Openzeppelin: