Submission Details
Severity:
Usage of SafeERC20 in upgradeable contracts
Summary
SmartVaultManagerV5.sol utilizes OpenZeppelin's ERC721Upgradeable.sol, OwnableUpgradeable.sol, and Initializable.sol contracts but lacks an upgradeable version of SafeERC20.sol within the file.
Vulnerability Details
The absence of an upgradeable version of SafeERC20.sol in SmartVaultManagerV5 contract with the other upgradeable contracts used. This might potentially lead to risks associated with non-upgradeable SafeERC20 implementations.
Impact
Lines of code:
import "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import "@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol";
import "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
contract SmartVaultManagerV5 is ISmartVaultManager, ISmartVaultManagerV2, Initializable, ERC721Upgradeable, OwnableUpgradeable {
using SafeERC20 for IERC20;
}
Tools Used
Manual Analysis
Recommendations
Make use of Open Zeppelins upgradeable version of the SafeERC20.sol contract.
Updates
Lead Judging Commences
hrishibhat almost 2 years ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933
USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.