Biconomy: Nexus

Summary

Storage of Nexus contract might be corrupted during an upgrade.

Vulnerability Details

The Nexus contract is intended to be upgradable, but do not have a __gap variable. This would become problematic if a subsequent version was to inherit one of these contracts. If the derived version were to have storage variables itself and additional storage variables were subsequently added to the inherited contract, a storage collision would occur.

Refer to this article:/upgrades https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#storage-gaps

Impact

Storage of Nexus might be corrupted during upgrading.

Tools Used

Manual review

Recommendations

Consider defining an appropriate storage gap at the end of the contract as follows: