First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Upgrading contract to `ThunderLoanUpgraded` breaks storage

codelock

Summary

This issue pertains to a contract upgrade in which the new contract, ThunderLoanUpgraded.sol, has a different variable order, leading to disruption in the original storage structure.

Vulnerability Details

In a foundry test, it was observed that when upgrading the contract ThunderLoan.sol to the new contract ThunderLoanUpgraded.sol, the order of variables in storage differs. This discrepancy results in the disruption of the original contract's storage layout.

Proof of Concept

function testUpgradeBreakStorage() public {
// Before
ThunderLoanUpgraded newImpl = new ThunderLoanUpgraded();
uint256 feeBefore = thunderLoan.getFee();
uint256 feePrecisionBefore = thunderLoan.getFeePrecision();
​
// When
thunderLoan.upgradeTo(address(newImpl));
ThunderLoanUpgraded thunderLoanUpgraded = ThunderLoanUpgraded(address(proxy));
​
// Checks
// flashloan fee changes after upgrade
assertNotEq(thunderLoanUpgraded.getFee(), feeBefore);
// flashloan fee now points to feePrecision storage slot
assertEq(thunderLoanUpgraded.getFee(), feePrecisionBefore);
}

Impact

The impact of this issue is assessed as medium. During the period when the contract is in an upgraded state, the protocol may operate incorrectly. However, it is important to note that this issue can be resolved by performing another upgrade.

Tools Used

Foundry

Recommendations

To address this issue, it is recommended to rectify the contract ThunderLoanUpgraded.sol before executing any further upgrades. Ensuring consistency in the storage structure between the original and upgraded contracts will prevent the disruption of storage during future upgrades, maintaining the integrity and stability of the protocol.

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

storage collision on upgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.