Part 2

Description

Several upgradeable contracts in the codebase inherit from OpenZeppelin's upgradeable contracts but do not implement the required storage gap variable (__gap). The following contracts are affected:

1. BaseAdapter.sol and its implementations:

   • UniswapV2Adapter.sol

   • UniswapV3Adapter.sol

   • CurveAdapter.sol

2. PriceAdapter.sol

3. Whitelist.sol

4. Referral.sol

5. ZlpVault.sol

6. TradingAccountNFT.sol

7. BaseKeeper.sol and its implementations:

   • DebtSettlementKeeper.sol

   • FeeConversionKeeper.sol

   • UsdTokenSwapKeeper.sol

When new variables are added to base contracts in future upgrades, they could overlap with the storage of the derived contracts, corrupting the state of the contract. The __gap array reserves storage slots for future versions, preventing storage collision during upgrades.

Impact

• Storage collisions could occur during contract upgrades if new variables are added to base contracts

• Could lead to corrupted state variables and unexpected behavior

• Particularly important for contracts handling user funds like ZlpVault and DEX adapters

Recommended Mitigation

Add a storage gap variable to all upgradeable contracts. Example for each contract type:

The size of the gap should be adjusted based on each contract's needs, typically aiming to reserve enough slots for future upgrades while considering gas costs. This pattern must be implemented in all the listed contracts to ensure safe upgradeability.