Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing gap in KatanaV3Pool #4

Closed
c4-bot-8 opened this issue Oct 30, 2024 · 3 comments
Closed

Missing gap in KatanaV3Pool #4

c4-bot-8 opened this issue Oct 30, 2024 · 3 comments
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working insufficient quality report This report is not of sufficient quality unsatisfactory does not satisfy C4 submission criteria; not eligible for awards

Comments

@c4-bot-8
Copy link
Contributor

Lines of code

https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3Pool.sol#L1-L795

Vulnerability details

Description

The KatanaV3Pool contract is intended to be an upgradeable smart contract, but do not have a __gap variable.
In upgradeable contracts, it's crucial to include a _gap to ensure that any additional storage variables added in future contract upgrades do not collide with existing storage variables. This is especially important when inheriting from multiple upgradeable contracts.

Recommended Mitigation Steps

Include a _gap as the last storage variable to the KatanaV3Pool contract to reserve space for future storage variables and prevent storage collisions when upgrading the contract in the future.

Assessed type

Upgradable
@c4-bot-8 c4-bot-8 added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Oct 30, 2024
c4-bot-6 added a commit that referenced this issue Oct 30, 2024
@c4-bot-6
BenRai issue #4
aa700b5
@khangvv
Copy link

khangvv commented Nov 1, 2024 •
edited
Loading

KatanaV3Pool does not inherit any storage parent contracts, meaning it doesn't need to reserve the storage gap. Therefore, I believe this issue is invalid.

@howlbot-integration howlbot-integration bot added the insufficient quality report This report is not of sufficient quality label Nov 4, 2024
@alex-ppg
Copy link

The Warden recommends the implementation of a gap variable for maintaining the storage entries of the KatanaV3Pool contract which, regardless of its validity as a recommendation, cannot constitute an HM vulnerability.

@c4-judge
Copy link

alex-ppg marked the issue as unsatisfactory:
Invalid

@c4-judge c4-judge added the unsatisfactory does not satisfy C4 submission criteria; not eligible for awards label Nov 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working insufficient quality report This report is not of sufficient quality unsatisfactory does not satisfy C4 submission criteria; not eligible for awards
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@alex-ppg @c4-judge @khangvv @c4-bot-8