crytic / crytic/slither

Detector idea: flag storage slot usage if contract is upgradeable

Open
#2,591 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
6.4k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

### Describe the desired feature

The idea here is that using [EIP-7201](https://eips.ethereum.org/EIPS/eip-7201) should be the recommended best-practice way of managing contract storage of upgradeable contracts. We can push best practice by flagging a finding on upgradeable contracts that store variables in the storage slots at the beginning of the contract (ex: variables listed in `slither --print variable-order`)

Upgradeable contracts can be vaguely identified by the presence of an initialize() function. This would limit false positives to factory-deployed contracts, confidence medium.

We can get better results by checking for inheritance of OZ's UUPSUpgradeable or similar contracts, confidence high.

Severity medium imo, but open to thoughts

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.