Upgradeable contracts not implement gaps could provocate a storage values being mixed up.
Summary
The upgradeable contracts lack proper implementation of gaps, which could lead to storage values being mixed up.
Vulnerability Details
Contracts are upgradeable and uses OwnableUpgradeable and UUPSUpgradeable. Following OpenZeppelin's instructions, it's advisable to include a __gap variable to prevent mixing up storage values during contract upgrades to new versions.
Openzeppelin resource: https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#modifying-your-contracts
Impact
Storage values can be mixed up when the contracts are upgraded to a new version.
Tools Used
Manual review.
Recommendations
Add to Distribution.sol, L1Sender.sol, L2MessageReceiver.sol and L2TokenReceiver.sol a __gap[50] variable.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.