[H-01] TITLE (L1Sender.sol contract is inheriting the non-upgradeable compatible ERC165 contract which will cause the storage collision.)
Description: In contract L1Sender.sol which is inheriting UUPSUpgradeable Proxy to make the contract upgradeable can have storage collision cause the L1Sender.sol contract is inheriting the regular ERC165 contract which does not have any reserve space which can cause storage collisions. The L1Sender.sol must use ERC165Upgradeable.sol contract which have extra reserve space and upgradeable compatible.
Impact: The impact of inheriting regular ERC165 contract in upgradeable compatible contract is that there can be issue of storage collisions.
Proof of Concept: (Proof Of Code)
The below code shows that L1Sender.sol contract is inheriting non upgradeable ERC165.sol contract.
pragma solidity ^0.8.20;
import {ILayerZeroEndpoint} from "@layerzerolabs/lz-evm-sdk-v1-0.7/contracts/interfaces/ILayerZeroEndpoint.sol";
import {IGatewayRouter} from "@arbitrum/token-bridge-contracts/contracts/tokenbridge/libraries/gateway/IGatewayRouter.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import {IL1Sender} from "./interfaces/IL1Sender.sol";
import {IWStETH} from "./interfaces/tokens/IWStETH.sol";
@>
contract L1Sender is IL1Sender, ERC165, OwnableUpgradeable, UUPSUpgradeable {}
Recommended Mitigation: Use ERC165Upgradeable.sol contract in the place of ERC165.sol contract. Which have extra reserve space and upgradeable compatible.
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
import {ILayerZeroEndpoint} from "@layerzerolabs/lz-evm-sdk-v1-0.7/contracts/interfaces/ILayerZeroEndpoint.sol";
import {IGatewayRouter} from "@arbitrum/token-bridge-contracts/contracts/tokenbridge/libraries/gateway/IGatewayRouter.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
- import {ERC165} from "@openzeppelin/contracts/utils/introspection/ERC165.sol";
+ import {ERC165Upgradeable} from "@openzeppelin/contracts-upgradeable/utils/introspection/ERC165Upgradeable.sol"
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
import {IL1Sender} from "./interfaces/IL1Sender.sol";
import {IWStETH} from "./interfaces/tokens/IWStETH.sol";
@> //@audit-ok L1Sender is inheriting now `ERC165Upgradeable.sol` contract which is upgradeable compatible.
contract L1Sender is IL1Sender, ERC165Upgradeable, OwnableUpgradeable, UUPSUpgradeable {}
