/
proxy-storage-collision.yaml
75 lines (75 loc) · 2.2 KB
/
proxy-storage-collision.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
rules:
-
id: proxy-storage-collision
message: Proxy declares a state var that may override a storage slot of the implementation
metadata:
category: security
technology:
- solidity
cwe: "CWE-787: Out-of-bounds Write"
confidence: HIGH
likelihood: MEDIUM
impact: HIGH
subcategory:
- vuln
references:
- https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22
patterns:
- pattern-either:
- pattern: |
contract $CONTRACT is ..., $PROXY, ... {
...
$TYPE $VAR;
...
constructor(...) {
...
}
...
}
- pattern: |
contract $CONTRACT is ..., $PROXY, ... {
...
$TYPE $VAR = ...;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE immutable $VAR;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE immutable $VAR = ...;
...
constructor(...) {
...
}
...
}
- pattern-not: |
contract $CONTRACT is ..., $PROXY, ... {
$TYPE constant $VAR = ...;
...
constructor(...) {
...
}
...
}
- metavariable-regex:
metavariable: $CONTRACT
regex: ^(?!AdminUpgradeabilityProxy|OwnedUpgrade*abilityProxy).*$
- metavariable-regex:
metavariable: $PROXY
regex: (UpgradeabilityProxy|AdminUpgradeabilityProxy|OwnedUpgrade*abilityProxy|TransparentUpgradeableProxy|ERC1967Proxy)
- focus-metavariable: $PROXY
languages:
- solidity
severity: WARNING