Submission Details
Severity:
Incorrect implementation of upgradeable `OperatorStakingPool` can lead to future storage collisions
Summary
Incorrect implementation of upgradeable OperatorStakingPool can lead to future storage collisions upon contract upgrade.
Vulnerability Details
The OperatorStakingPool is designed to be UUPSUpgradeable. However, it lacks one core best practice regarding UUPSUpgradeable contracts.
It lacks the provision of reserved storage slots: uint256[] __gap.
For more details on how to implement UUPS Upgradeable contracts, watch Guardian Audit Owen's YouTube video here: https://youtu.be/6aPyykZhglM?si=CfSLd3ENICZD8pLg
Impact
Storage collision in future upgrades is possible.
Tools Used
Manual Review.
Recommendations
Include uint256[] __gap .
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020
USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.