Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Storage Gap Missing In Upgradeable Contract

waydou

Summary

The MembershipERC1155 contract is upgradeable but lacks a storage gap variable. This makes the contract vulnerable to storage collisions during future upgrades, particularly when new variables need to be added. The absence of a storage gap variable is a significant risk for upgradeable contracts as it could lead to storage layout corruption.

Vulnerability Details

The contract MembershipERC1155 inherits from ERC1155Upgradeable and AccessControlUpgradeable and is deployed behind a proxy, When deployed via the factory:

TransparentUpgradeableProxy proxy = new TransparentUpgradeableProxy(
membershipImplementation,
address(proxyAdmin),
abi.encodeWithSignature("initialize(string,string,string,address,address)", daoConfig.ensname, "OWP", baseURI, _msgSender(), daoConfig.currency)
);

The contract allows implementation upgrades through updateMembershipImplementation
However, there's no storage gap to reserve slots for future variable additions, making upgrades potentially dangerous.

Impact

Storage Collision Risk

Adding new state variables in upgraded versions could overwrite existing storage
Cannot safely add new storage variables in upgrades
Reduces contract flexibility and maintainability
Storage collisions could corrupt token balances

Tools Used

Manual Review

Recommendations

Add explicit storage layout versioning

uint256[50] private __gap;
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.