054.md

Square Vermilion Alpaca

Medium

No Storage Gap for Upgradeable Contract Might Lead to Storage Slot Collision

Vulnerability Details The AccessControl base contract is inherited in upgradeable contracts

• EthosVouch.sol
• ReputationMarket)

Suppose storage variables are added to these base contracts without accounting for a storage gap towards the child contracts. In that case, a storage collision may cause contracts to malfunction and compromise other functionalities.

Storage Variable in AccessControl without considering storage gap!

@>  IContractAddressManager public contractAddressManager;

Recommended Mitigation Consider adding a gap variable to future-proof base contract storage changes and be safe against storage collisions.

+ uint256[50] private __gap;