Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing UUPS inheritance in `LevelTwo` prevents contract upgrade due to invalid ERC1967 implementation

s3bc40

Summary

LevelTwo contract does not inherit from UUPSUpgradeable contract but only from Initializable. This means that it will not comply with ERC1967, which ensure a consistent location where proxies store the implementation address they delegate calls to. Therefore, the LevelOne::graduateAndUpgrade function will not be able to upgrade to LevelTwo contract and will revert on an invalid implementation.

import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
​
contract LevelTwo is Initializable {

See https://eips.ethereum.org/EIPS/eip-1967

Impact

The LevelOne::graduateAndUpgrade function will not be able to upgrade to LevelTwo contract and will revert on an invalid implementation, clocking the system.

Proof of Concept

  1. Deploy LevelTwo contract without inheriting from UUPSUpgradeable.

  2. Call the LevelOne::graduateAndUpgrade function with the LevelTwo implementation address.

  3. The function will revert on an invalid implementation following ERC1967.

├─ [4351] ERC1967Proxy::fallback(LevelTwo: [0x2e234DAe75C793f67A35089C9d99245E1C58470b], 0xd3618cca)
│ ├─ [3855] LevelOne::graduateAndUpgrade(LevelTwo: [0x2e234DAe75C793f67A35089C9d99245E1C58470b], 0xd3618cca) [delegatecall]
│ │ ├─ [224] LevelTwo::proxiableUUID() [staticcall]
│ │ │ └─ ← [Revert] EvmError: Revert
│ │ └─ ← [Revert] ERC1967InvalidImplementation(0x2e234DAe75C793f67A35089C9d99245E1C58470b)
│ └─ ← [Revert] ERC1967InvalidImplementation(0x2e234DAe75C793f67A35089C9d99245E1C58470b)

Tools Used

Manual review.

Recommendations

LevelTwo contract should inherit from UUPSUpgradeable contract to ensure that it complies with ERC1967. This will ensure that the LevelOne::graduateAndUpgrade function can upgrade to LevelTwo contract without any issues.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!