Description:Description\
Storage gaps are utilized by upgradeable contracts to reserve space in storage for future state variables in new implementation versions.
VoterUpgradeable.sol reserves 50 storage slots for future version of the implementation via uint256[50] __gap.
VoterUpgradeableV1_2.sol is a new version of the implementation that adds new state variables. As it is also an upgradeable contract, it must reserve storage slots for future implementations. However, it incorrectly does so by using uint256[50] __gap. Instead, it should be uint256[49] __gap. This is because the following new state variable was added:
Github username: @rilwan99 Twitter username: Ril11111 Submission hash (on-chain): 0xeae3d33c8222565cc65c2507d01a7610d811df60b123f11e40cd0657762ed133 Severity: medium
Description: Description\ Storage gaps are utilized by upgradeable contracts to reserve space in storage for future state variables in new implementation versions. VoterUpgradeable.sol reserves 50 storage slots for future version of the implementation via
uint256[50] __gap
.VoterUpgradeableV1_2.sol is a new version of the implementation that adds new state variables. As it is also an upgradeable contract, it must reserve storage slots for future implementations. However, it incorrectly does so by using
uint256[50] __gap
. Instead, it should beuint256[49] __gap
. This is because the following new state variable was added:uint256 public distributionWindowDuration;
See (https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#storage-gaps)
Attack Scenario\ If this incorrect gap size is not addressed:
distributionWindowDuration
, potentially leading to data corruption.Attachments
Proof of Concept (PoC) File
Revised Code File (Optional) Replace
uint256[50] private __gap
on line 977 in VoterUpgradeableV1_2.sol withuint256[49] private __gap
.