Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`LevelTwo` contract is not UUPSUpgradable so `LevelOne` contract can not be upgraded to `LevelTwo` contract.

manaxtech

Description: LevelTwo contract is suppose to be after LevelOne contract after upgrade but LevelTwo contract does not inherit UUPSUpgradable, so when we try to upgrade from LevelOne to LevelTwo contract we get an Error of ERC1967Utils.ERC1967InvalidImplementation

Vulnerability Details: LevelTwo contract does not inherit UUPSUpgradable contract

Impact: we can not upgrade to LevelTwo contract

Tools Used: Manual Review

Proof of Concept: Make sure LevelTwo you haven't added UUPSUpgradable

Proof of Code
function test_UpgradeFails() public {
vm.startPrank(principal);
levelOneProxy.addTeacher(alice);
levelOneProxy.addTeacher(bob);
vm.stopPrank();
​
vm.startPrank(clara);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(dan);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(eli);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(fin);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(grey);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
vm.startPrank(harriet);
usdc.approve(address(levelOneProxy), schoolFees);
levelOneProxy.enroll();
vm.stopPrank();
​
bytes memory data = abi.encodeCall(LevelTwo.graduate, ());
vm.startPrank(principal);
levelOneProxy.graduateAndUpgrade(levelTwoImplementationAddress, data);
vm.expectRevert();
levelOneProxy.upgradeToAndCall(levelTwoImplementationAddress, data);
vm.stopPrank();
}

Recommendations: import the UUPSUpgradable function to LevelTwo and inherit it after that add the authorize function in LevelTwo

Updates

Lead Judging Commences

yeahchibyke Lead Judge
6 months ago
yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed upgrade

The system doesn't implement UUPS properly.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.