Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Vulnerable Upgradability Pattern due to lack of storage gap implementation

cayde

Summary

Storage of upgradeable contracts will be corrupted during an upgrade.

Vulnerability Detail

Note: The contracts highlighted in Orange mean that there is no gap slots defined.

graph BT;
classDef nogap fill:#f96;
classDef hasgap fill:#99cc00;
StakingRewardsPool-->StakingPool:::nogap
Strategy-->VaultControllerStrategy:::hasgap
VaultControllerStrategy:::nogap-->CommunityVCS:::nogap
VaultControllerStrategy:::nogap-->OperatorVCS:::nogap
Vault:::hasgap-->OperatorVault:::nogap
​

There gap storage has not been implemented on the StakingPool/OperatorVault/CommunityVCS/OperatorVCS that have state variables that are non-constant nor immutable.

Without gaps, adding new storage variables to any of these contracts can potentially overwrite the beginning of the storage layout of the child contract, causing critical misbehaviors in the system.

The following contracts, do have state variables that
For StakingPool.sol
StakingPool.sol#L27

uint256 public totalStaked;

For OperatorVault.sol
OperatorVault.sol#L19-L20

address internal _identityOperator;

For CommunityVCS.sol
CommunityVCS.sol#L13-L14

uint128 public vaultDeploymentThreshold;

For OperatorVCS.sol
OperatorVCS.sol#L15-L16

uint256 public operatorRewardPercentage;

Impact

Without gaps, adding new storage variables during contract upgrades can overwrite existing storage layout slots in child contracts, causing critical misbehavior in the system, including data loss, and incorrect logic execution.

Recommendation

Add gaps for contracts that have mutable state variables.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.