Summary

The LevelTwo contract introduces state variables in an incompatible order with LevelOne, risking storage collisions during upgrades.

Vulnerability Details

When upgrading from LevelOne to LevelTwo, the storage layout differs. For example:

• LevelOne has schoolFees as the third variable, while LevelTwo replaces it with sessionEnd.

• LevelTwo omits variables like reviewCount and lastReviewTime.

This mismatch causes critical variables (e.g., principal, bursary) to reference incorrect storage slots, leading to data corruption.

Impact

Storage corruption could reset principal to a wrong address, lock funds, or break core functionalities like fee distribution.

Tools Used

Recommendations

Maintain identical storage layouts between upgraded contracts. Use @openzeppelin/contracts-upgradeable’s StorageGap pattern to reserve slots for future variables.