Skip to content

Latest commit

 

History

History
36 lines (27 loc) · 1022 Bytes

010.md

File metadata and controls

36 lines (27 loc) · 1022 Bytes

Proud Rusty Mantis

High

Collision will cause wrong storage

Vulnerability Detail

The in-scope Unitroller contract acts similar as a proxy - it holds the storage for the comptroller but delegates to it for the functionality:

* @dev Storage for the comptroller is at this address, while execution is delegated to the `comptrollerImplementation`.
 * CTokens should reference this contract as their comptroller.
 */
contract Unitroller ... {
    ...
}

The issue is that their storage slots are not compatible. The first storage slots of the comptroller are based on the inherited ComptrollerV7Storage:

contract NumaComptroller is ComptrollerV7Storage, ....

If we take a look at Unitroller, we will see the following:

contract Unitroller is UnitrollerAdminStorage, ComptrollerErrorReporter {

Attack Path

No response

Impact

Storage will be completely wrong causing all kinds of issues

Mitigation

Make the storages between the contracts compatible