Summary

The MembershipERC1155 contract is upgradeable but lacks a storage gap variable. This makes the contract vulnerable to storage collisions during future upgrades, particularly when new variables need to be added. The absence of a storage gap variable is a significant risk for upgradeable contracts as it could lead to storage layout corruption.

Vulnerability Details

The contract MembershipERC1155 inherits from ERC1155Upgradeable and AccessControlUpgradeable and is deployed behind a proxy, When deployed via the factory:

The contract allows implementation upgrades through updateMembershipImplementation
However, there's no storage gap to reserve slots for future variable additions, making upgrades potentially dangerous.

Impact

Storage Collision Risk

Adding new state variables in upgraded versions could overwrite existing storage
Cannot safely add new storage variables in upgrades
Reduces contract flexibility and maintainability
Storage collisions could corrupt token balances

Tools Used

Manual Review

Recommendations

Add explicit storage layout versioning