Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`StabilityPool` inherits non-upgradable version of `ReentrancyGuard`, potentially breaking the upgradability mechanims

alexczm

Summary

StabilityPool is intended to be upgradable but inherits the non-upgradable version of OZ's ReentrancyGuard.

Vulnerability Details

StabilityPool is intended to be upgradable and inherits from the following contracts:

contract StabilityPool is IStabilityPool, Initializable, ReentrancyGuard, OwnableUpgradeable, PausableUpgradeable {

ReentrancyGuard is a non-upgradable contract and does not have the necessary initializers which are essential for proxy-based upgradeability mechanisms.

Even if OZ upgradable contracts starting with version 5.0 (the version RAAC project uses) use a namespaced stroage layout instead of __gaps, problems can still arise due to changes in the inheritance order of contracts.

Impact

Inheriting from a non-upgradable contract may lead to issues when upgrading the implementation.

Tools Used

Recommendations

Inherit the ReentrancGuardUpgradable; initialize it in StabilityPool::initialize.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.