DeFiFoundry
20,000 USDC
View results
Submission Details
Severity: medium
Invalid

[High-Severity-1] Duplicate ERC20 contract names may lead to unexpected behavior and security risks

[High-Severity-1] Duplicate ERC20 contract names may lead to unexpected behavior and security risks

Description

If a codebase has two contracts with similar names, the compilation artifacts will not contain one of the contracts with the duplicate name. This can lead to unexpected behavior and conflicts during deployment.

  1. Unexpected Behavior: Having duplicate contract names can lead to unexpected behavior during deployment and execution, which can be critical in a blockchain environment where immutability and predictability are key.

  2. Security Risks: Inconsistent use of contract implementations can introduce security vulnerabilities, especially if one implementation has different security features or bugs compared to the other.

The issue could lead to future problems, even though it does not present an immediate threat according to the code implemented at the time of this audit.

Proof of Concept

ERC20 is re-used:

  • ERC20 (lib/openzeppelin-contracts/contracts/token/ERC20/ERC20.sol)

  • ERC20 (lib/solmate/src/tokens/ERC20.sol)

Recommended Mitigation

Choose one implementation of the ERC20 contract and use it consistently throughout your project. Remove the import statement for the ERC20 contract you decide not to use and ensure all references to the ERC20 contract in your project are updated to use the chosen implementation.

Updates

Lead Judging Commences

inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.