Tadle

Summary

Vulnerability Details

In the TadleFactory contract, the deployUpgradeableProxy function is responsible for deploying upgradeable proxy contracts for various related contracts. This function allows the guardian to deploy a new proxy contract that delegates calls to a specified logic (implementation) contract. However, there is a potential issue when the function is called multiple times with the same _relatedContractIndex, leading to the overwriting of previously deployed proxy contracts.

How Proxy and Implementation Contracts Work

Proxy Contract:

• Storage: The proxy contract holds the state variables (storage) that persist across upgrades.

• Delegation: It uses the delegatecall opcode to delegate calls to the logic (implementation) contract. This means that the logic contract's code is executed in the context of the proxy contract, allowing it to read and write to the proxy's storage.

Logic (Implementation) Contract:

• Code: The logic contract contains the actual code (functions) that define the behavior of the contract.

• Upgradability: When an upgrade is needed, a new logic contract is deployed, and the proxy contract is updated to point to the new logic contract. The storage remains intact in the proxy contract.

Deployment Process:

1. Deploying the Proxy:

   • The deployUpgradeableProxy function creates a new instance of UpgradeableProxy.

   • The constructor of UpgradeableProxy is called with the address of the logic contract (_logic), the guardian address, the factory address, and any initialization data (_data).

2. Proxy Contract:

   • The UpgradeableProxy contract holds the storage.

   • It delegates calls to the logic contract specified during deployment.

3. Logic Contract:

   • The logic contract contains the actual implementation of the functions.

   • If the logic needs to be updated, a new logic contract is deployed, and the proxy contract's reference to the logic contract is updated.

Overwriting of Related Contracts

The deployUpgradeableProxy function allows the guardian to deploy a new proxy contract for a specified related contract index. However, if this function is called multiple times with the same _relatedContractIndex, the address of the previously deployed proxy contract will be overwritten in the relatedContracts mapping. This means that the reference to the first deployed proxy contract will be lost, and only the address of the most recently deployed proxy contract will be stored.

The address of the previously deployed proxy contract will be overwritten in the relatedContracts mapping. This could lead to the loss of reference to the initial proxy contract and its associated logic.

Calling deployUpgradeableProxy twice with the same _relatedContractIndex will result in the second proxy contract overwriting the first one in the relatedContracts mapping. This could be intentional or an issue depending on the intended use case. If it is not desirable to overwrite the previous contract, additional logic should be added to prevent redeployment for the same index.

Impact

Tools Used

Manual Analysis

Recommendations

To prevent overwriting, you could add a check to ensure that a proxy contract has not already been deployed for the given _relatedContractIndex