019.md

Small Hazel Lemur

Medium

Corrupted storage after upgrade in the contract

Summary

Corrupted storage after upgrade in the contract

Root Cause

from the commit differences we can see that uint256 invalidation; is not placed after all variables

After the upgrade, the newly upgraded smart contract would be reading from storage slots that contain data no longer corresponding to the new storage layout. This would cause the system to break in an unpredictable manner, depending on the number of storage slots added as part of the upgrade

    /// @dev The invalidation status semaphore (local only)
    ///      (0 = no invalidation possible / intent only, 1+ = partially or fully invalidatable)
    uint256 invalidation;

    /// @dev The referral fee multiplied by the size applicable to the referral
    UFixed6 makerReferral;

    /// @dev The referral fee multiplied by the size applicable to the referral
    UFixed6 takerReferral;
}

types/Order.sol#L46

the same you can see at currenlty deployed version, takerReferral is the last:

    /// @dev The negative skew short order size
    UFixed6 shortNeg;

    /// @dev The protection status semaphore (local only)
    uint256 protection;

    /// @dev The referral fee multiplied by the size applicable to the referral
    UFixed6 makerReferral;

    /// @dev The referral fee multiplied by the size applicable to the referral
    UFixed6 takerReferral;
}

0x17ebca0060c3e84812ab4e208cc33e5fd8a3b255#code#F51#L46

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

1. Corrupted storage of the Order contract.
2. System would break in an unpredictable manner. similar issue was in previous contest

PoC

No response

Mitigation

    /// @dev The invalidation status semaphore (local only)
    ///      (0 = no invalidation possible / intent only, 1+ = partially or fully invalidatable)
-    uint256 invalidation;

    /// @dev The referral fee multiplied by the size applicable to the referral
    UFixed6 makerReferral;

    /// @dev The referral fee multiplied by the size applicable to the referral
    UFixed6 takerReferral;

+   uint256 invalidation;
}