Open
Description
Describe the desired feature
The idea here is that using EIP-7201 should be the recommended best-practice way of managing contract storage of upgradeable contracts. We can push best practice by flagging a finding on upgradeable contracts that store variables in the storage slots at the beginning of the contract (ex: variables listed in slither --print variable-order
)
Upgradeable contracts can be vaguely identified by the presence of an initialize() function. This would limit false positives to factory-deployed contracts, confidence medium.
We can get better results by checking for inheritance of OZ's UUPSUpgradeable or similar contracts, confidence high.
Severity medium imo, but open to thoughts