Storage collision between proxy and implementation
Summary
The UpgradeableProxy contract's design intends to use the first storage slot for the admin address and the second slot for the tadleFactory address. However, the actual implementation of ITadleFactory public tadleFactory may inadvertently use the first storage slot, potentially conflicting with the admin address.
Vulnerability Details
Natspec of contract UpgradeableProxy:
When we run commnad forge inspect UpgradeableProxy storage we see that slot0 which is the first slot is not occupied by the admin as expected but rather the tadle contract
This article will help you get a better understanding of the problem
https://docs.openzeppelin.com/upgrades-plugins/1.x/proxies
section "Unstructured Storaged Proxies"
Impact
Impact would be that an upgrade could brick a contract by simply rearranging inheritance order, or adding variables to an inherited contract, since the implantation slot will not be where it is expected
Tools Used
Manual Review , Foundry
Recommendations
Consider using EIP1967
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.