Liquid Staking

Summary

The contracts are upgradeable but lacks/contains low storage gap. Without or a low storage gap, future versions of the contract may introduce new variables that overwrite storage slots in unexpected ways, potentially corrupting the contract’s state. This issue arises from Solidity's use of sequential storage slots, where new variables can be written into slots reserved for other purposes in the original version of the contract.

Affected Contracts

• https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/StakingPool.sol#L15

• https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/priorityPool/PriorityPool.sol#L30

• https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/core/priorityPool/WithdrawalPool.sol#L33

• https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/Vault.sol#L39

• https://github.com/Cyfrin/2024-09-stakelink/blob/f5824f9ad67058b24a2c08494e51ddd7efdbb90b/contracts/linkStaking/base/VaultControllerStrategy.sol#L375

Impact

Without a storage gap or low storage gap, new storage variables introduced in the contracts can overwrite the beginning of the storage layout, causing unexpected behavior and potentially severe vulnerabilities

Tools Used

Manual

Recommendations

Introduce a storage gap in the contract to reserve space for future storage variables without affecting the contract's storage layout. Or you can use namespace variables.