Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Storage gap for `Vault` is not enough

Dup1337

Summary

Storage gap in Vault has only 9 elements.
According to best practices outlined in OpenZeppelin updareability docs,

If Base is later modified to add extra variable(s), reduce the appropriate number of slots from the storage gap, keeping in mind Solidity’s rules on how contiguous items are packed.

Vulnerability Details

The storage gap provided in Vault is too small:

abstract contract Vault is Initializable, UUPSUpgradeable, OwnableUpgradeable {
using SafeERC20Upgradeable for IERC20Upgradeable;
​
// address of staking token
IERC20Upgradeable public token;
// address of strategy that controls this vault
address public vaultController;
// address of Chainlink staking contract
IStaking public stakeController;
// address of Chainlink staking rewards contract
IStakingRewards public rewardsController;
​
// storage gap for upgradeability
@> uint256[9] private __gap; // @audit too small

So, ideally it should be 50 - 4 = 46 storage gap. Currently, it can only hold 9 new fields, which might turn out not to be enough in the future.

Impact

Possible upgradeability issues in the future.

Tools Used

Manual review

Recommendations

Change storage gap to 46 elements:

abstract contract Vault is Initializable, UUPSUpgradeable, OwnableUpgradeable {
using SafeERC20Upgradeable for IERC20Upgradeable;
​
// address of staking token
IERC20Upgradeable public token;
// address of strategy that controls this vault
address public vaultController; // @info OperatorVCS or CommunityVCS
// address of Chainlink staking contract
IStaking public stakeController;
// address of Chainlink staking rewards contract
IStakingRewards public rewardsController;
​
// storage gap for upgradeability
- uint256[9] private __gap;
+ uint256[46] private __gap;
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.