Upgradeable Contracts doesn't use storage gap for some inherited contracts

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-blur/blob/2fdaa6e13b544c8c11d1c022a575f16c3a72e3bf/contracts/BlurExchange.sol#L30

Vulnerability details

Impact

The BlurExchange contract is upgradeable but inherit from ReentrancyGuarded and EIP712 which both does not have a storage gap. If in a future upgrade, additionnals state variables were to be added to one or both of these contracts it would shifts down all of the state variables below in the inheritance chain and potentially overwrite storage slots of the BlurExchange contract.

Proof of Concept

Link: https://github.com/code-423n4/2022-10-blur/blob/2fdaa6e13b544c8c11d1c022a575f16c3a72e3bf/contracts/BlurExchange.sol#L30

contract BlurExchange is IBlurExchange, ReentrancyGuarded, EIP712, OwnableUpgradeable, UUPSUpgradeable {

Openzeppelin notes about this: https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps

Link to a similar issue: code-423n4/2022-05-rubicon-findings#67

Tools Used

Manual review.

Recommended Mitigation Steps

Add a storage gap to existing ReentrancyGuarded and EIP712 contracts.

[GalloDaSballo]

Dup of #410

[GalloDaSballo]

L