Summary

Without gaps, adding new storage variables to contracts can potentially overwrite the beginning of the storage layout of the child contract, causing critical misbehaviors in the system.

Vulnerability Details

The Starklane bridge contract utilizes an upgradable pattern and inherits from several contracts: StarklaneState, StarklaneEscrow, StarklaneMessaging, and CollectionManager. Each of these contracts defines state variables, but they do not implement gap storage.

In an upgradable contract pattern, adding new storage variables to any of the inherited contracts can overwrite existing storage variables in the child contract due to the tightly packed storage layout. This can lead to critical misbehaviors and potentially catastrophic system failures.

Impact

Storage of contracts might be corrupted during an upgrade.

Tools Used

vscode

Recommendations

Add gaps for inherited contracts.