_Follow along with the video lesson:_ --- ### Exploit - Storage Collision - Storage Refresher If you're already very familiar with storage, feel free to skip this lesson. Otherwise, we're going to go through a quick refresher on storage in Solidity. So, **_How does storage work?_** ::image{src='/security-section-6/43-exploit-storage-collision-storage-refresher/exploit-storage-collision-storage-refresher1.png' style='width: 100%; height: auto;'} Variables in a smart contract get saved to storage sequentially. The first declaration being assigned slot 0, the second, slot 1 etc. Storage _isn't_, but can be thought of as an array of 32 byte slots, in which each variable is allocated. ::image{src='/security-section-6/43-exploit-storage-collision-storage-refresher/exploit-storage-collision-storage-refresher2.png' style='width: 100%; height: auto;'} Mapping and arrays are handled uniquely by the solidity compiler. The length of these items is stored in the next available slot (like normal), but the elements, or content of the mappings/arrays are stored in a separate slot. This slot is determined by a hash function on the first slot. ::image{src='/security-section-6/43-exploit-storage-collision-storage-refresher/exploit-storage-collision-storage-refresher3.png' style='width: 100%; height: auto;'} Constant variables are **not** assigned storage slots, these are stored directly in a contract's bytecode. ::image{src='/security-section-6/43-exploit-storage-collision-storage-refresher/exploit-storage-collision-storage-refresher4.png' style='width: 100%; height: auto;'} Variables initialized within a function also **do not** get assigned storage slots. These variables exist only for the duration of the function call and as such are kept in memory. ::image{src='/security-section-6/43-exploit-storage-collision-storage-refresher/exploit-storage-collision-storage-refresher5.png' style='width: 100%; height: auto;'} ### Upgrading When a contract is upgraded, the variables within it are mapped to the same storage slots that the original implementation had. These are the storage slots that the proxy is expecting very specific variables to be found in. By changing the order of our variables we assure that the incorrect values/types will be referenced throughout the upgrades logic. ::image{src='/security-section-6/43-exploit-storage-collision-storage-refresher/exploit-storage-collision-storage-refresher6.png' style='width: 100%; height: auto;'} ### Wrap Up Now that we've reminded ourselves of some fundamental ways storage works in the EVM. The next lesson should be quick, we're going to walk through a diagram that illustrates storage collision in more detail!