Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

[L-1] Storage Collision Risk in Upgradeable Contract (Data Corruption)

0xsnoweth

Summary

Missing storage gap risks future upgrade failures and data corruption.

Vulnerability Details

Affected Code:

struct ZlpVaultStorage {
address marketMakingEngine;
uint8 decimalsOffset;
uint128 vaultId; // No storage gap
}

Collision Scenario:

  1. Future upgrade adds uint256 feeAccumulator

  2. New variable occupies slot 3 (previously unused)

  3. Subsequent upgrade adds address feeCollector

  4. feeCollector overwrites feeAccumulator data

Impact

Low Impact: Potential upgrade failures

Low Likelihood: Requires multiple improper upgrades

Technical Debt: Increases maintenance complexity

Tools Used

Manual storage layout analysis

Recommendations

struct ZlpVaultStorage {
address marketMakingEngine;
uint8 decimalsOffset;
uint128 vaultId;
uint256[50] __gap; // Reserve 50 slots
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.