Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Programmable Derivatives>Low findings>OracleReader does not have a storage gap
GeneralOverview
Findings
Critical (2)
High (9)
Medium (4)
Low (3)The governance may fail to set the feeOracleReader does not have a storage gapPotentially obtaining a stale price
Informational (2)
DiscussionInconsistencies between documentation and implementation
Threat ModelWhat are threat models?Auction.solBalancerOracleAdapter.solBondToken.solDistributor.solLeverageToken.solOracleReader.solPool.solPoolFactory.solPreDeposit.sol
Audit ResultsAssessment Results
Category: Business Logic

OracleReader does not have a storage gap

Low Severity
Low Impact
N/A Likelihood

Description

When using upgradable contracts, storage gaps are used for reserving storage slots in a base contract, allowing upgrades of that contract to use up those slots without affecting the storage layout. However, the upgradable contract OracleReader does not have a storage-gap variable, and it is inherited by other contracts — for example, the contract BalancerOracleAdapter.

Impact

If new storage variables are added to the contract OracleReader in the future, it will affect the storage variables in the child contract.

Recommendations

Consider adding a gap variable to be safe against storage collisions.

Remediation

This issue has been acknowledged by Plaza Finance, and a fix was implemented in commit 8e298db4↗.

Zellic © 2025Back to top ↑