Storage Corruption risk in the StakingPool contract
Summary
Storage of the StakingPool contract may be corrupted during an upgrade.
Vulnerability Detail
The StakingPool contract is meant to be upgradeable. However, it inherits the StakingRewardsPool contract, which is not upgrade-safe. No gap storage is implemented on StakingRewardsPool. Without gaps, adding new storage variables to the StakingRewardsPool contract could potentially overwrite the beginning of the storage layout of the child contract, causing storage collision and critical misbehaviors in the system.
Impact
Storage of the StakingPool contract may be corrupted during upgrading.
Tools Used
Manual Review
Recommendations
Add storage gaps to the StakingRewardsPool contract.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.