Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-6] `LevelTwo.sol` is not `UUPSUpgradable`, making it impossible for the protocol to upgrade to the contract

sa1nt

Description: Contract LevelTwo.sol is not inheriting the UUPSUpgradable contract from OpenZeppelin. This means that the protocol can not be upgraded from LevelOne.sol to LevelTwo.sol. For a UUPSUpgradable OpenZeppelin contract to be upgraded to another contract it needs for the other contract to also be inheriting from UUPSUpgradable.

Impact: The protocol can not be upgraded, breaking the whole idea of the protocol.

Proof of Concept: We can see in this test when trying to call upgradeToAndCall function it will revert because the LevelTwo.sol contract is not inheriting from UUPSUpgradable.

Put this in the LevelOneAndGraduateTest.t.sol:

function testCanNotUpgradeToLevelTwo() public schoolInSession {
levelTwoImplementation = new LevelTwo();
levelTwoImplementationAddress = address(levelTwoImplementation);
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
​
vm.prank(principal);
vm.expectRevert();
levelOneProxy.upgradeToAndCall(levelTwoImplementationAddress, data); // reverts
}

Recommended Mitigation: Easiest way to fix is to make the LevelTwo.sol contract also inherit from UUPSUpgradable. If you want the protocol to still be upgradable add the _authorizeUpgrade in the same manner as in LevelOne.sol, otherwise, make the _authorizeUpgrade function revert.

import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
+ import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
​
//@audit-high not UUPSUpgradeable which means it is not upgradeable
+ contract LevelTwo is Initializable, UUPSUpgradeable {
using SafeERC20 for IERC20;
.
.
.
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!