Storage Layout mismatch between LevelOne & LevelTwo
Vulnerability Details
Storage Layout Comparison: LevelOne vs LevelTwo
| Slot | Variable | Type | Description | LevelOne (V1) | LevelTwo (V2) |
|---|---|---|---|---|---|
| 0 | principal |
address |
Address of the principal | ✅ (address) | ✅ (address) |
| 1 | inSession |
bool |
Boolean indicating if the session is active | ✅ (bool) | ✅ (bool) |
| 2 | schoolFees |
uint256 |
The school fees | ✅ (uint256) | ❌ (Removed) |
| 3 | reviewTime |
uint256 (constant) |
Duration of the review period (immutable) | ✅ (constant) | ❌ (Not present) |
| 4 | sessionEnd |
uint256 |
Timestamp when the session ends | ✅ (uint256) | ✅ (uint256) |
| 5 | bursary |
uint256 |
Amount of bursary | ✅ (uint256) | ✅ (uint256) |
| 6 | cutOffScore |
uint256 |
Cut-off score for eligibility | ✅ (uint256) | ✅ (uint256) |
| 7 | isTeacher (mapping) |
mapping(address => bool) |
Mapping to track if an address is a teacher | ✅ (mapping) | ✅ (mapping) |
| 8 | isStudent (mapping) |
mapping(address => bool) |
Mapping to track if an address is a student | ✅ (mapping) | ✅ (mapping) |
| 9 | studentScore (mapping) |
mapping(address => uint256) |
Mapping to store student scores | ✅ (mapping) | ✅ (mapping) |
| 10 | reviewCount (mapping) |
mapping(address => uint256) |
Mapping to store review count | ✅ (mapping) | ❌ (Not present) |
| 11 | lastReviewTime (mapping) |
mapping(address => uint256) |
Mapping to store last review time | ✅ (mapping) | ❌ (Not present) |
| 12 | listOfStudents |
address[] |
Array of student addresses | ✅ (array) | ✅ (array) |
| 13 | listOfTeachers |
address[] |
Array of teacher addresses | ✅ (array) | ✅ (array) |
| 14 | TEACHER_WAGE |
uint256 (constant) |
Percentage of teacher wage (immutable) | ✅ (constant) | ❌ (Not present) |
| 15 | PRINCIPAL_WAGE |
uint256 (constant) |
Percentage of principal wage (immutable) | ✅ (constant) | ❌ (Not present) |
| 16 | PRECISION |
uint256 (constant) |
Constant value used for precision | ✅ (constant) | ✅ (constant) |
| 17 | usdc |
IERC20 |
The USDC token address | ✅ (IERC20) | ✅ (IERC20) |
| 10 | TEACHER_WAGE_L2 |
uint256 (constant) |
Percentage of teacher wage (immutable) | ❌ (Not present) | ✅ (constant) |
| 11 | PRINCIPAL_WAGE_L2 |
uint256 (constant) |
Percentage of principal wage (immutable) | ❌ (Not present) | ✅ (constant) |
Key Differences
-
Removed Variables:
schoolFees,reviewTime,reviewCount, andlastReviewTimeare removed inLevelTwo, which can lead to data corruption if the proxy is not handled correctly.
-
Reordered Variables:
The positions of
sessionEnd,cutOffScore, and other variables have changed between versions. This could cause misalignment of storage in the proxy.
-
New Variables:
TEACHER_WAGE_L2andPRINCIPAL_WAGE_L2are introduced inLevelTwo, potentially causing confusion or errors if not correctly handled during the upgrade.
Impact
-
This invariant would break as
bursarystorage slot will mismatchremaining 60% should reflect in the bursary after upgrade
Recommendation
To ensure compatibility and prevent data corruption when upgrading, always maintain the same storage layout across different contract versions or properly migrate the state variables.
Lead Judging Commences
storage collision
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.