-
Notifications
You must be signed in to change notification settings - Fork 66
Description
Description
The TokenController contract is deployed using a delegate proxy and will be upgraded as part of the Nexus V2 release. As the contract's storage layout was modified, coverInfo mapping's storage slot would be changed. As a result, all the existing coverInfo entries would become inaccessible and prevent users from migrating their existing cover.
A Foundry test case was used to record the storage slots accessed when interacting with the existing implementation versus the new implementation.
function testStorage() public {
TokenController newControllerImpl = new TokenController(address(0),address(0));
TokenController oldControllerImpl = TokenController(0xcafea8cF7044dcfe97fb33D32DA71D0f3fe3053f);
vm.record();
oldControllerImpl.coverInfo(0);
vm.accesses(address(oldControllerImpl));
vm.record();
newControllerImpl.coverInfo(0);
vm.accesses(address(newControllerImpl));
}
The results of the test case is shown below:
[PASS] testStorage() (gas: 2977180)
Traces:
[2977180] CoverTest::testStorage()
├─ [2927025] → new TokenController@0x210503c318855259983298ba58055A38D5FF63E0
│ └─ ← 14617 bytes of code
├─ [0] VM::record()
│ └─ ← ()
├─ [2555] 0xcafea8cF7044dcfe97fb33D32DA71D0f3fe3053f::coverInfo(0) [staticcall]
│ └─ ← 0, false, false
├─ [0] VM::accesses(0xcafea8cF7044dcfe97fb33D32DA71D0f3fe3053f)
│ └─ ← [0x5eff886ea0ce6ca488a3d6e336d6c0f75f46d19b42c06ce5ee98e42c96d256c7], []
├─ [0] VM::record()
│ └─ ← ()
├─ [2612] TokenController::coverInfo(0) [staticcall]
│ └─ ← 0, false, false
├─ [0] VM::accesses(TokenController: [0x210503c318855259983298ba58055A38D5FF63E0])
│ └─ ← [0x13da86008ba1c6922daee3e07db95305ef49ebced9f5467a0b8613fcc6b343e3], []
└─ ← ()
As can be observed, the storage slot index between the two calls differs. The slot indexes can be manually calculated for coverInfo[0] to confirm the issue.
Array index 0 of mapping at slot 8
$ cast index uint256 0 8
0x5eff886ea0ce6ca488a3d6e336d6c0f75f46d19b42c06ce5ee98e42c96d256c7
Array index 0 of mapping at slot 10
$ cast index uint256 0 10
0x13da86008ba1c6922daee3e07db95305ef49ebced9f5467a0b8613fcc6b343e
Recommendation
The storage slot position of coverInfo should be maintained. At the time of the audit, the _unused4 storage slot corresponded with the existing coverInfo slot.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status