Storage Corruption risk in the VaultControllerStrategy contract
Summary
Storage of the VaultControllerStrategy contract may be corrupted during an upgrade.
Vulnerability Detail
The VaultControllerStrategy contract is meant to be upgradeable. However, it inherits the Strategy contract, which is not upgrade-safe. No gap storage is implemented on Strategy. Without gaps, adding new storage variables to the Strategy contract could potentially overwrite the beginning of the storage layout of the child contract, causing storage collision and critical misbehaviors in the system.
Impact
Storage of the VaultControllerStrategy contract may be corrupted during upgrading.
Tools Used
Manual Review
Recommendations
Add storage gaps to the Strategy contract.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.