Dria
Swan
NFTHardhat
21,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Upgrade `SWAN` contract can totally break all existing `buyerAgent`

0xdemon

Summary

SWAN.sol is a UUPSUpgradeable contract

contract Swan is SwanManager, UUPSUpgradeable {
​

When this contract is upgraded, all existing buyerAgentmust be redeployed because of the change in implementation address of SWAN.sol which results in all functions on buyerAgent being irrelevant and cant be use because they use the old implementation address of SWAN.sol

Vulnerability Details

All existing buyerAgent must be redeployed because the SWAN.sol contract address on the buyerAgent is set to immutable and even if it doesn't have immutable modifier there is no function on BuyerAgent.sol to set a new implementation address when SWAN.sol is upgraded

Swan public immutable swan;
​

SWAN.sol contract address set in the constructor when a new buyerAgent is deployed

constructor(
string memory _name,
string memory _description,
uint96 _royaltyFee,
uint256 _amountPerRound,
address _operator,
address _owner
) Ownable(_owner) {
if (_royaltyFee < 1 || _royaltyFee > 100) {
revert InvalidFee(_royaltyFee);
}
royaltyFee = _royaltyFee;
​
swan = Swan(_operator);
amountPerRound = _amountPerRound;
name = _name;
description = _description;
createdAt = block.timestamp;
marketParameterIdx = swan.getMarketParameters().length - 1;
​
// approve the coordinator to take fees
// a max approval results in infinite allowance
swan.token().approve(address(swan.coordinator()), type(uint256).max);
swan.token().approve(address(swan), type(uint256).max);
}
​

Impact

  1. All existing buyerAgentmust be redeployed

  2. If the upgrade is done other than during the withdraw phase, the buyerAgent owner must leave funds locked in contract equivalent to minFundAmount to make withdrawal for all owned funds and then redeploy new buyerAgentusing new Swan.solcontract

  3. All existing NFT owned by buyerAgent will be locked forever because there is no function to transfer NFT to new deployed buyerAgent

Tools Used

Manual Review

Recommended Mitigation

Consider remove immutable modifier and add setter function for SWAN contract address in BuyerAgent.sol

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

0xdemon Submitter
12 months ago
0xdemon Submitter
12 months ago
inallhonesty Lead Judge
12 months ago
inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.