Core Contracts

Summary

The StabilityPool contract is designed to be an upgradeable contract, but it imports the non-upgradeable version of ReentrancyGuard from OpenZeppelin. This creates a critical incompatibility because non-upgradeable contracts cannot be safely used in upgradeable contracts. This issue can lead to storage layout conflicts and unexpected behavior during upgrades, potentially compromising the contract's functionality and security.

Vulnerability Details

Upgradeable contracts rely on a specific storage layout to ensure compatibility between different versions of the contract.The non-upgradeable ReentrancyGuard introduces its own storage variables, which can conflict with the storage layout of the upgradeable StabilityPool contract. This can result in data corruption or unintended behavior when the contract is upgraded.

The storage variables of ReentrancyGuard may overwrite or interfere with the storage variables of the StabilityPool contract.

Impact

• Storage Corruption: The storage variables of ReentrancyGuard may overwrite or interfere with the storage variables of the StabilityPool contract.

• Upgrade Failures: Upgrading the contract may fail or result in unexpected behavior due to storage layout mismatches.

• Security Risks: The reentrancy protection mechanism may not work as intended, leaving the contract vulnerable to reentrancy attacks.

The impact is Medium, the likelihood is Low, so the severity is Low.

Tools Used

Manual Review

Recommendations

To resolve this issue, replace the non-upgradeable ReentrancyGuard with the upgradeable version provided by OpenZeppelin (ReentrancyGuardUpgradeable).