Skip to content

Latest commit

 

History

History
80 lines (50 loc) · 2.17 KB

045.md

File metadata and controls

80 lines (50 loc) · 2.17 KB

Fast Khaki Raccoon

Medium

No gap inside DecentralizedIndex

Summary

DecentralizedIndex is an abstract contract with storage variables

https://github.com/sherlock-audit/2025-01-peapods-finance/blob/main/contracts/contracts/DecentralizedIndex.sol#L17

abstract contract DecentralizedIndex is Initializable, ERC20Upgradeable, ERC20PermitUpgradeable, IDecentralizedIndex {

    using SafeERC20 for IERC20;

    uint16 constant DEN = 10000; // 10K
    uint8 constant SWAP_DELAY = 20; // seconds

    IProtocolFeeRouter PROTOCOL_FEE_ROUTER;
    IRewardsWhitelister REWARDS_WHITELIST;
    IDexAdapter public override DEX_HANDLER;
    IV3TwapUtilities V3_TWAP_UTILS;

    uint256 public FLASH_FEE_AMOUNT_DAI; // 10 DAI
    address public PAIRED_LP_TOKEN;
    address CREATOR;
    address V2_ROUTER;
    address V3_ROUTER;
    address DAI;
    address WETH;
    address V2_POOL;

that is implemented in WeightedIndex, which also has values

https://github.com/sherlock-audit/2025-01-peapods-finance/blob/main/contracts/contracts/WeightedIndex.sol#L13

contract WeightedIndex is Initializable, IInitializeSelector, DecentralizedIndex {
    using SafeERC20 for IERC20;

    uint256 private _totalWeights;

Both contracts are upgradable in mind, which can be seen from bot of them having initialize and inheriting upgradable contracts.

However if DecentralizedIndex gets upgraded it's storage would clash with WeightedIndex bricking both contracts and costing all of the funds inside WeightedIndex.

Note that this can be spotted in other places around the codebase.

Root Cause

DecentralizedIndex missing a gap, while having upgradability in mind.

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

  1. DecentralizedIndex is upgraded and 1 new variable is introduced
  2. Storage clashes with WeightedIndex, causing the whole contract to be inoperable
  3. All funds are lost

Impact

If DecentralizedIndex gets upgraded it's storage would clash with WeightedIndex bricking both contracts and costing all of the funds inside WeightedIndex.

PoC

No response

Mitigation

Implement gap[50]