Submission Details
Severity:
The storage slots corresponding to _implementation could be accidentally overwritten
Summary
The storage slots corresponding to _implementation could be accidentally overwritten
Vulnerability Details
/**
* @dev Delegate all the calls to implementation contract
*/
fallback() external {
address implementation = _implementation;
assembly {
let ptr := mload(0x40)
calldatacopy(ptr, 0, calldatasize())
let result := delegatecall(gas(), implementation, ptr, calldatasize(), 0, 0)
let size := returndatasize()
returndatacopy(ptr, 0, size)
switch result
case 0 { revert(ptr, size) }
default { return(ptr, size) }
}
According to the sparkn Doc, all the calls to proxy contract will be delegated to the implementation(distributor) contract.
Therefore, the storage slots are shared with the storage space of the Distributor contract.
Impact
_implementation is at slots 0, there is a risk of them being overridden.
Tools Used
Recommendations
You might consider using eip-1967.
An example of how the randomized storage is achieved, following EIP 1967:
bytes32 private constant implementationPosition = bytes32(uint256(
keccak256('eip1967.proxy.implementation')) - 1
));
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.