Core Contracts

Summary

The StabilityPool contract is upgradeable but uses a non-upgradeable ReentrancyGuard, creating a potential vulnerability.

Vulnerability Details

• The non-upgradeable ReentrancyGuard is incompatible with the proxy pattern used in upgradeable contracts.

Impact

• State Inconsistency: Improper state management during upgrades could break contract functionality.

• Loss of Funds: Users could suffer financial losses if exploited.

Tools Used

Manual code review.

Recommendations

1. Replace ReentrancyGuard with ReentrancyGuardUpgradeable:

   import "@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol";

   contract StabilityPool is IStabilityPool, Initializable, ReentrancyGuardUpgradeable, OwnableUpgradeable, PausableUpgradeable {

   // Contract logic

   }

2. Initialize ReentrancyGuardUpgradeable in the initialize function:

   function initialize() public initializer {

   __ReentrancyGuard_init();

   __Ownable_init();

   __Pausable_init();

   }