Hawk High

Summary

The renaming of constants (TEACHER_WAGE to TEACHER_WAGE_L2 and PRINCIPAL_WAGE to PRINCIPAL_WAGE_L2) is a vulnerability as it creates inconsistency in the upgrade process. Missing details on why the new naming , we are not sure if the inteded purpose is to add additional variables or repalce existing.

Vulnerability Details

The constant names are changed between contracts:

Issues:

1. resulting bytecode will be different

2. Inconsistent naming convention breaks upgrade compatibility

3. No validation for constant name changes

4. Potential for confusion in contract interaction

5. Error prone since devs would need to update those new variabke names everywhere

Impact

• Upgrade Compatibility: Breaks the upgrade pattern or makes it a lot harder to update, due the need for detailed check if names properly changed on all occurencies

• Code Maintainability: Creates confusion in contract interaction

• Contract Integrity: Undermines the upgrade process

• Harder documentation: Documentations need to be changed everytime with the new name

• Verification: need to re-verify the contract with the new source code

Tools Used

• Manual code review

Recommendations

1. Maintain consistent constant names across versions

2. Use storage gaps to prevent collisions

3. Add validation for constant changes

4. Document any necessary constant changes

5. Consider implementing a migration function for constant changes