Radiant Ginger Raven - Corruptible Upgradability Pattern

[sherlock-admin2]

Radiant Ginger Raven

Medium

Corruptible Upgradability Pattern

Summary

The EthosContracts (EthosVouch, ReputationMarket, ...) are UUPSUpgradeable. However, the current implementation has multiple issues regarding upgradability.

The Ethos contracts are meant to be upgradeable. However, it inherits contracts that are not upgrade-safe.

ReentrancyGuard

Root Cause

https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/EthosVouch.sol#L67
https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/ReputationMarket.sol#L36

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Storage of vault contracts might be corrupted during upgrading.

PoC

No response

Mitigation

Use library from Openzeppelin-upgradeable instead, e.g. ReentrancyGuardUpgradeable