Incorrect storage slot assignments
Summary
The LevelTwo contract has incorrect storage slot assignments for various variables. This can lead to unexpected behavior and security vulnerabilities.
Vulnerability Details
The LevelTwo contract has incorrect storage slot assignments for sessionEnd, bursary, cutOffScore, isTeacher, isStudent, studentScore, listOfStudents, listOfTeachers, and usdc. This can lead to unexpected behavior and security vulnerabilities.
The LevelOne contract has the following storage layout:
| Name | Type | Slot | Offset | Bytes | Contract |
|---|---|---|---|---|---|
| principal | address | 0 | 0 | 20 | src/LevelOne.sol:LevelOne |
| inSession | bool | 0 | 20 | 1 | src/LevelOne.sol:LevelOne |
| schoolFees | uint256 | 1 | 0 | 32 | src/LevelOne.sol:LevelOne |
| sessionEnd | uint256 | 2 | 0 | 32 | src/LevelOne.sol:LevelOne |
| bursary | uint256 | 3 | 0 | 32 | src/LevelOne.sol:LevelOne |
| cutOffScore | uint256 | 4 | 0 | 32 | src/LevelOne.sol:LevelOne |
| isTeacher | mapping(address => bool) | 5 | 0 | 32 | src/LevelOne.sol:LevelOne |
| isStudent | mapping(address => bool) | 6 | 0 | 32 | src/LevelOne.sol:LevelOne |
| studentScore | mapping(address => uint256) | 7 | 0 | 32 | src/LevelOne.sol:LevelOne |
| reviewCount | mapping(address => uint256) | 8 | 0 | 32 | src/LevelOne.sol:LevelOne |
| lastReviewTime | mapping(address => uint256) | 9 | 0 | 32 | src/LevelOne.sol:LevelOne |
| listOfStudents | address[] | 10 | 0 | 32 | src/LevelOne.sol:LevelOne |
| listOfTeachers | address[] | 11 | 0 | 32 | src/LevelOne.sol:LevelOne |
| usdc | contract IERC20 | 12 | 0 | 20 | src/LevelOne.sol:LevelOne |
The LevelTwo contract has the following storage layout:
| Name | Type | Slot | Offset | Bytes | Contract |
|---|---|---|---|---|---|
| principal | address | 0 | 0 | 20 | src/LevelTwo.sol:LevelTwo |
| inSession | bool | 0 | 20 | 1 | src/LevelTwo.sol:LevelTwo |
| sessionEnd | uint256 | 1 | 0 | 32 | src/LevelTwo.sol:LevelTwo |
| bursary | uint256 | 2 | 0 | 32 | src/LevelTwo.sol:LevelTwo |
| cutOffScore | uint256 | 3 | 0 | 32 | src/LevelTwo.sol:LevelTwo |
| isTeacher | mapping(address => bool) | 4 | 0 | 32 | src/LevelTwo.sol:LevelTwo |
| isStudent | mapping(address => bool) | 5 | 0 | 32 | src/LevelTwo.sol:LevelTwo |
| studentScore | mapping(address => uint256) | 6 | 0 | 32 | src/LevelTwo.sol:LevelTwo |
| listOfStudents | address[] | 7 | 0 | 32 | src/LevelTwo.sol:LevelTwo |
| listOfTeachers | address[] | 8 | 0 | 32 | src/LevelTwo.sol:LevelTwo |
| usdc | contract IERC20 | 9 | 0 | 20 | src/LevelTwo.sol:LevelTwo |
Impact
The impact of this vulnerability is MEDIUM, as it can lead to unexpected behavior in the LevelTwo contract.
Tools Used
Manual review, forge inspection
Recommendations
Consider changing the storage slot of the LevelTwo contract to match the one of the LevelOne contract.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.