Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Non-Upgradeable ReentrancyGuard Can Cause Storage Collision

anomX

Summary

The StabilityPool contract inherits from ReentrancyGuard instead of ReentrancyGuardUpgradeable while being an upgradeable contract. This can lead to storage collisions and potential contract corruption during upgrades.

Vulnerability Details

Source

The contract is designed to be upgradeable as shown by its inheritance of Initializable, OwnableUpgradeable, and PausableUpgradeable. However, it uses the non-upgradeable version of ReentrancyGuard:

contract StabilityPool is IStabilityPool, Initializable, ReentrancyGuard, OwnableUpgradeable, PausableUpgradeable {

This creates a potential issue because the non-upgradeable ReentrancyGuard uses fixed storage slots that could collide with the storage layout of the upgradeable contract pattern.

Proof of Concept

  1. The current contract is deployed with the following inheritance:

    • Initializable

    • ReentrancyGuard (non-upgradeable)

    • OwnableUpgradeable

    • PausableUpgradeable

  2. When the contract is upgraded:

    • The non-upgradeable ReentrancyGuard storage layout remains fixed

    • New storage variables could potentially collide with the ReentrancyGuard's storage slot

    • This could corrupt the reentrancy guard's state variable

Impact

  • Potential storage collisions during contract upgrades

  • Possible corruption of the reentrancy guard's state

  • Risk of reentrancy attacks if the guard's state is corrupted

  • Contract upgrades could become unsafe or impossible

Tools Used

  • Manual code review

Recommendations

Replace the non-upgradeable ReentrancyGuard with its upgradeable counterpart.

Mitigation Steps

- import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
+ import "@openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol";
​
- contract StabilityPool is IStabilityPool, Initializable, ReentrancyGuard, OwnableUpgradeable, PausableUpgradeable {
+ contract StabilityPool is IStabilityPool, Initializable, ReentrancyGuardUpgradeable, OwnableUpgradeable, PausableUpgradeable {
​
function initialize(...) public initializer {
__Ownable_init(_initialOwner);
__Pausable_init();
+ __ReentrancyGuard_init();
// ... rest of initialization
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!