The Standard

Summary

The SmartVaultManagerV5 contract is intended to be used as a logic contract with a proxy, but does not have a __gap variable. This would become problematic if a subsequent version was to inherit this contract. If the derived version were to have storage variables itself and additional storage variables were subsequently added to the inherited contract, a storage collision would occur.

Vulnerability Details

Please refer to this OpenZeppelin article about Storage gaps:
https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#storage-gaps

Impact

Possible storage collision with child contracts which can have very serious consequences.

Tools Used

Manual review

Recommendations

Consider appending a __gap variable as the last storage variable to these upgradeable contracts, such that the storage slots sum up to a fixed amount (e.g. 50). This will proof any future storage layout changes to the base contract.