Skip to content

Add _reentrancyGuardStorageSlot() #5688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

EricForgy
Copy link

Fixes #5681 for ReentrancyGuardTransient.

This PR introduces a pure virtual function _reentrancyGuardStorageSlot() in ReentrancyGuardTransient.sol, mirroring the pattern used in the upgradeable Initializable.sol

Motivation

As discussed in #5681, storage slot collisions can occur when using OpenZeppelin contracts in delegatecall-based modular systems (e.g., the Diamond Standard). While this issue was originally raised in the context of upgradeable contracts, ReentrancyGuardTransient.sol in the non-upgradeable repo is in fact already upgrade-safe due to its use of a named storage slot.

Adding _reentrancyGuardStorageSlot() as a pure virtual function allows advanced users to override the default slot location safely in derived contracts, which is essential when using multiple delegatecall modules that each instantiate ReentrancyGuardTransient.

Summary of Changes

  • Introduced _reentrancyGuardStorageSlot(), marked internal pure virtual
  • Replaced all direct uses of REENTRANCY_GUARD_STORAGE with calls to this new function
  • No behavioral or storage layout changes; fully backward-compatible

Copy link

changeset-bot bot commented May 16, 2025

🦋 Changeset detected

Latest commit: 750a60b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
openzeppelin-solidity Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@gonzaotc gonzaotc requested review from Amxx and gonzaotc May 26, 2025 17:27
@gonzaotc
Copy link
Contributor

Approved, I consider allowing storage slot overridability while keeping the formula pure a good tradeoff between flexibility and security, as mentioned in #5681 (comment). Additionally, we will work on the transpiler to ensure this same pattern is correctly applied across the upgradeable contracts.

@Amxx
Copy link
Collaborator

Amxx commented May 27, 2025

While this looks good, I'd like to consider a different approach. See #5681 (comment)

'openzeppelin-solidity': patch
---

Add `_reentrancyGuardStorageSlot()` to `ReentrancyGuardTransient` as a `pure virtual` function to allow slot overrides for diamond-compatible modular usage. Related to #5681.
Copy link
Collaborator

@Amxx Amxx May 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Add `_reentrancyGuardStorageSlot()` to `ReentrancyGuardTransient` as a `pure virtual` function to allow slot overrides for diamond-compatible modular usage. Related to #5681.
`ReentrancyGuardTransient`: Add `_reentrancyGuardStorageSlot()`, a `pure virtual` function, that can be overriden to allow slot customization.

return _reentrancyGuardStorageSlot().asBoolean().tload();
}

function _reentrancyGuardStorageSlot() internal pure virtual returns (bytes32) {
Copy link
Collaborator

@Amxx Amxx May 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should that be

  • _reentrancyGuardStorageSlot()
  • _reentrancyGuardTransientSlot()
  • _reentrancyGuardTransientStorageSlot()

Here, the contract only uses transient, but what if a contract combined transient and normal storage ? Would we want the two types to use the same slot, or would we allow separating the two ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Storage Slot Collisions in Diamond-Compatible Delegatecall Architecture (Upgradeable Contracts)
3 participants