Skip to content

Audit 5.1.4 Unable to migrate cover due to changes to contract's slot layout #592

@roxdanila

Description

@roxdanila

TokenController.sol#L33

Description
The TokenController contract is deployed using a delegate proxy and will be upgraded as part of the Nexus V2 release. As the contract's storage layout was modified, coverInfo mapping's storage slot would be changed. As a result, all the existing coverInfo entries would become inaccessible and prevent users from migrating their existing cover.

A Foundry test case was used to record the storage slots accessed when interacting with the existing implementation versus the new implementation.

function testStorage() public {
TokenController newControllerImpl = new TokenController(address(0),address(0));
TokenController oldControllerImpl = TokenController(0xcafea8cF7044dcfe97fb33D32DA71D0f3fe3053f);

vm.record();
oldControllerImpl.coverInfo(0);
vm.accesses(address(oldControllerImpl));

vm.record();
newControllerImpl.coverInfo(0);
vm.accesses(address(newControllerImpl));

}
The results of the test case is shown below:

[PASS] testStorage() (gas: 2977180)
Traces:
[2977180] CoverTest::testStorage()
├─ [2927025] → new TokenController@0x210503c318855259983298ba58055A38D5FF63E0
│ └─ ← 14617 bytes of code
├─ [0] VM::record()
│ └─ ← ()
├─ [2555] 0xcafea8cF7044dcfe97fb33D32DA71D0f3fe3053f::coverInfo(0) [staticcall]
│ └─ ← 0, false, false
├─ [0] VM::accesses(0xcafea8cF7044dcfe97fb33D32DA71D0f3fe3053f)
│ └─ ← [0x5eff886ea0ce6ca488a3d6e336d6c0f75f46d19b42c06ce5ee98e42c96d256c7], []
├─ [0] VM::record()
│ └─ ← ()
├─ [2612] TokenController::coverInfo(0) [staticcall]
│ └─ ← 0, false, false
├─ [0] VM::accesses(TokenController: [0x210503c318855259983298ba58055A38D5FF63E0])
│ └─ ← [0x13da86008ba1c6922daee3e07db95305ef49ebced9f5467a0b8613fcc6b343e3], []
└─ ← ()
As can be observed, the storage slot index between the two calls differs. The slot indexes can be manually calculated for coverInfo[0] to confirm the issue.

Array index 0 of mapping at slot 8

$ cast index uint256 0 8
0x5eff886ea0ce6ca488a3d6e336d6c0f75f46d19b42c06ce5ee98e42c96d256c7

Array index 0 of mapping at slot 10

$ cast index uint256 0 10
0x13da86008ba1c6922daee3e07db95305ef49ebced9f5467a0b8613fcc6b343e

Recommendation
The storage slot position of coverInfo should be maintained. At the time of the audit, the _unused4 storage slot corresponded with the existing coverInfo slot.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

Status

✅ Done

Relationships

None yet

Development

No branches or pull requests

Issue actions