Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

parzival - Stablecoin.sol and AmirX.sol are upgradable contracts but inherit from contracts that does not have storage gap #217

Open
sherlock-admin4 opened this issue Nov 13, 2024 · 0 comments

Comments

@sherlock-admin4
Copy link

sherlock-admin4 commented Nov 13, 2024

parzival

Medium

Stablecoin.sol and AmirX.sol are upgradable contracts but inherit from contracts that does not have storage gap

Summary

Stablecoin.sol inherits from Blacklist.sol and AmirX.sol inherits from StablecoinHandler.sol both of which contains storage variables but does not have gap variables in them. These gap variables are necessary since the contracts are intended to be upgradable and no gap can lead to storage collisions.

Root Cause

In StablecoinHandler.sol:21 and [Blacklist.sol:14](https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/util/abstract/Blacklist.sol#L14) we can see storage variables being created in the parent contracts. If proper gap variables are not added then upgrading these contracts might lead to storage collisions.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

Already explained in the Summary and root cause.

Mitigation

Add storage gaps to all inherited contracts that contain storage variables.

@sherlock-admin3 sherlock-admin3 changed the title Cheerful Chili Koala - Stablecoin.sol and AmirX.sol are upgradable contracts but inherit from contracts that does not have storage gap parzival - Stablecoin.sol and AmirX.sol are upgradable contracts but inherit from contracts that does not have storage gap Nov 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant