Skip to content

Upgradeable Base Missing Storage Gap

SAFE-0128 Upgradeability Checked automatically by the scanner
1

What goes wrong

An upgradeable/inheritable base contract declares state but no __gap storage reservation. Adding a variable to the base in a later version shifts every child's storage slots, silently corrupting all existing data after the upgrade.

2

The vulnerable pattern

proof of concept — how it is exploited
// V1 base: { uint a; }  child: { uint b @ slot1 }
// V2 base: { uint a; uint c; } -> child.b now reads slot2
// every stored b is misread; balances/owners scrambled after upgrade.
3

How to fix it

the pattern that is safe
// reserve slots so future base variables don't collide with child storage
uint256[50] private __gap;
Add uint256[50] __gap to every upgradeable base.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0128 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs