All contracts in scope implements an upgradeable contract from OZ. However, those contracts misses _gap variable, which can cause corruptible storage when being upgraded.
Root Cause
Stablecoin contract implements ERC20PermitUpgradeable and Blacklist:
contract Stablecoin is ERC20PermitUpgradeable, Blacklist
and Blacklist also implements AccessControlUpgradeable:
abstract contract Blacklist is AccessControlUpgradeable
The similar applies to StablecoinHandler and AmirX:
abstract contract StablecoinHandler is
AccessControlUpgradeable,
PausableUpgradeable
contract AmirX is StablecoinHandler
But _gap is missing, when either one of those contracts gets upgraded, it can cause corrupted storage, breaking contract states.
y4y
Medium
Corruptible storage pattern in multiple contracts
Summary
All contracts in scope implements an upgradeable contract from OZ. However, those contracts misses
_gapvariable, which can cause corruptible storage when being upgraded.Root Cause
Stablecoincontract implementsERC20PermitUpgradeableandBlacklist:and
Blacklistalso implementsAccessControlUpgradeable:The similar applies to
StablecoinHandlerandAmirX:But
_gapis missing, when either one of those contracts gets upgraded, it can cause corrupted storage, breaking contract states.Internal pre-conditions
No response
External pre-conditions
No response
Attack Path
No response
Impact
Storage can be broken when being upgraded.
PoC
No response
Mitigation
Add
_gapto all upgradeable contracts.