First Flight #3: Thunder Loan

Summary

Upgradeable contract is missing a __gap[50] storage variable to allow for new storage variables in later versions

Vulnerability Details

See this link for a description of this storage variable. While some contracts may not currently be sub-classed, adding the variable now protects against forgetting to add it in the future.

Lines of code

Total -> 6

8, 76, 141, 76, 141, 7

Impact

This is empty reserved space in storage that is put in place in Upgradeable contracts. It allows us to freely add new state variables in the future without compromising the storage compatibility with existing deployments.

Tools used

Manual review

Recommended Mitigation Steps

Reference: https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#modifying-your-contracts