Description

The LevelOne contract is designed to be upgradable, where graduateAndUpgrade() points to a new contract (LevelTwo) using UUPS (Universal Upgradeable Proxy Standard).

However, there is a storage layout mismatch between LevelOne and LevelTwo. Specifically

LevelOne includes:

uint256 public immutable reviewTime;
mapping(address => uint256) public reviewCount;
mapping(address => uint256) private lastReviewTime;

These fields are missing in LevelTwo.

Impact

1) Upgraded contract will read/write from incorrect storage slots.

2) Loss of data integrity

Tools Used

1) Vs code
2) Manual review

Recommendations

Always ensure that the storage layout in the upgraded contract matches exactly with the original one.