Submission Details
Severity:
missing gap will brick the contracts when they are upgraded
Summary
Vulnerability Details
VaultDepositController is using Strategy, which in tern is upgradable. However the Strategy contract is missing a vital part of it's storage system - the __gap
abstract contract Strategy is IStrategy, Initializable, UUPSUpgradeable, OwnableUpgradeable {
IERC20Upgradeable public token;
IStakingPool public stakingPool;
//@audit missing gap, if upgraded it will corrupt all integrations, i.e. VCS
function __Strategy_init(address _token, address _stakingPool) public onlyInitializing {
token = IERC20Upgradeable(_token);
stakingPool = IStakingPool(_stakingPool);
__Ownable_init();
__UUPSUpgradeable_init();
}
Without it if the contract is upgraded and a storage variable is added then this variable will push the storage slots by 1, corrupting VCS or any other contract that inherits from Strategy. This will break VCS and cause it's user to lose their funds.
Impact
If upgraded contracts storage will be corrupted, i.e. contract is bricked and users lose their funds.
Tools Used
Manual review.
Recommendations
Add gaps to all contracts that are missing it.
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020 USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.