Submission Details
Severity:
Inconsistent Storage Layout Between LevelOne and LevelTwo Contracts
Summary
The LevelTwo.sol contract has a different storage layout compared to LevelOne.sol, which can lead to storage collisions when upgrading the contract through a proxy pattern.
Vulnerability Details
Storage variables in LevelTwo.sol are not aligned with LevelOne.sol
Different order or types of state variables can cause storage collisions
LevelTwo.sol
address principal;
bool inSession;
uint256 public sessionEnd;
uint256 public bursary;
uint256 public cutOffScore;
mapping(address => bool) public isTeacher;
mapping(address => bool) public isStudent;
mapping(address => uint256) public studentScore;
address[] listOfStudents;
address[] listOfTeachers;
uint256 public constant TEACHER_WAGE_L2 = 40;
uint256 public constant PRINCIPAL_WAGE_L2 = 5;
uint256 public constant PRECISION = 100;
LevelOne.sol
address principal;
bool inSession;
uint256 schoolFees;
uint256 public immutable reviewTime = 1 weeks;
uint256 public sessionEnd;
uint256 public bursary;
uint256 public cutOffScore;
mapping(address => bool) public isTeacher;
mapping(address => bool) public isStudent;
mapping(address => uint256) public studentScore;
mapping(address => uint256) private reviewCount;
mapping(address => uint256) private lastReviewTime;
address[] listOfStudents;
address[] listOfTeachers;
uint256 public constant TEACHER_WAGE = 35; // 35%
uint256 public constant PRINCIPAL_WAGE = 5; // 5%
uint256 public constant PRECISION = 100;
Impact
High: Storage collisions can lead to:
Corrupted data
Unexpected behavior
Potential loss of funds
Contract malfunction
Tools Used
Manual code review
Recommendations
Ensure storage variables in LevelTwo.sol match exactly with LevelOne.sol
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.