Sparkn

Summary

The vulnerability involves a lack of compliance with EIP1967 in Proxy contract and can potentially lead to storage collisions and variable overwrites. This arises due to the shared storage layout between Proxy contract and Distributor contract.

Vulnerability Details

When you implement proxies, logic and implementation share the same storage layout. In order to avoid storage conflicts EIP1967 was proposed.

For example, according to the standard, the slot for for logic address should be

0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc which can be obtained using the following bytes32(uint256(keccak256('eip1967.proxy.implementation')) - 1).

Impact

Storage collisions can lead to unexpected contract behavior, incorrect outputs, or unauthorized manipulation of sensitive information.

Tools Used

Manual Review

Recommendations

Consider using EIP1967 to ensure that storage conflicts are avoided in proxy contract.