BaseUpgradeable is using a non-upgradeable dependency

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/BaseUpgradeable.sol#L9

Vulnerability details

Impact

BaseUpgradeable is using a non-upgradeable dependency (BaseAbstract) which will eventually break upgradeability

Proof of Concept

Currently, the BaseUpgradeable contract inherits the BaseAbstract contract. The BaseUpgradeable contract is meant to be used by a proxy contract which means that all dependencies should be proxy capable as well. The issue for BaseAbstract lies in the missing _gap variable. If a state variable is ever added to BaseAbstract this will result in a storage collision with all other storage slots, in this case it would break the storage in Initializable.sol and BaseUpgradeable.sol.

This issue is of course also present in TokenggAVAX.sol since BaseUpgradeable is there inherited as well.

Tools Used

VSCode, remix

Recommended Mitigation Steps

Consider copying the BaseAbstract contract, rename it to BaseAbstractUpgradeable and add a _gap variable to it.

uint256[50] private __gap;

[c4-judge]

GalloDaSballo marked the issue as duplicate of #300

[c4-judge]

GalloDaSballo marked the issue as not a duplicate

[c4-judge]

Duplicate of #710

[GalloDaSballo]

L