search

sherlock-audit / 2023-06-dinari-judging

5 stars 4 forks source link

serial-coder - Adding storage gaps for future version upgrades #110

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

serial-coder

medium

Adding storage gaps for future version upgrades

Summary

The OrderProcessor and BuyOrderIssuer are base contracts of other child contracts. They should add storage gaps, guaranteeing their future versions (OrderProcessor and BuyOrderIssuer) will be upgradeable without conflicting with the storage layout of child contracts.

Vulnerability Detail

The OrderProcessor is a base contract of:

  1. BuyOrderIssuer child contract
  2. DirectBuyIssuer child contract
  3. SellOrderProcessor child contract

Whereas the BuyOrderIssuer can be a base contract of the DirectBuyIssuer child contract.

Impact

Without adding the storage gaps in advance, the future version upgrades of the OrderProcessor and BuyOrderIssuer may conflict with the storage layout of the child contracts.

Subsequently, the platform's contracts may not be upgradeable as planned.

Code Snippet

OrderProcessor: https://github.com/sherlock-audit/2023-06-dinari/blob/main/sbt-contracts/src/issuer/OrderProcessor.sol#L37

BuyOrderIssuer: https://github.com/sherlock-audit/2023-06-dinari/blob/main/sbt-contracts/src/issuer/BuyOrderIssuer.sol#L16

DirectBuyIssuer: https://github.com/sherlock-audit/2023-06-dinari/blob/main/sbt-contracts/src/issuer/DirectBuyIssuer.sol#L28

SellOrderProcessor: https://github.com/sherlock-audit/2023-06-dinari/blob/main/sbt-contracts/src/issuer/SellOrderProcessor.sol#L17

Tool used

Manual Review

Recommendation

Recommend adding storage gaps to the OrderProcessor and BuyOrderIssuer base contracts to guarantee future version upgrades as expected.