HIGH severity: Use the getStorage() / NAMESPACE pattern instead of global variables. The facet DexManagerFacet and the inherited contracts Swapper.sol / SwapperV2.sol define a global variable appStorage on the first storage slot.

Vulnerable code:
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.7;

import { ILiFi } from "../Interfaces/ILiFi.sol";
import { LibSwap } from "../Libraries/LibSwap.sol";
import { LibAsset } from "../Libraries/LibAsset.sol";
import { LibStorage } from "../Libraries/LibStorage.sol";
import { LibAsset } from "../Libraries/LibAsset.sol";
import { InvalidAmount, ContractCallNotAllowed, NoSwapDataProvided } from "../Errors/GenericErrors.sol";

contract Swapper is ILiFi {
    /// Storage ///

    LibStorage internal ls;

    /// @dev Sends any leftover balances back to the user
    modifier noLeftovers(LibSwap.SwapData[] calldata _swapData) {
        uint256 nSwaps = _swapData.length;
        if (nSwaps != 1) {
            uint256[] memory initialBalances = _fetchBalances(_swapData);
            address finalAsset = _swapData[nSwaps - 1].receivingAssetId;
            uint256 curBalance = 0;

            _;

            for (uint256 i = 0; i < nSwaps - 1; i++) {
                address curAsset = _swapData[i].receivingAssetId;
                if (curAsset == finalAsset) continue; // Handle multi-to-one swaps
                curBalance = LibAsset.getOwnBalance(curAsset) - initialBalances[i];
                if (curBalance > 0) LibAsset.transferAsset(curAsset, payable(msg.sender), curBalance);
            }
        } else _;
    }

    function _executeAndCheckSwaps(LiFiData calldata _lifiData, LibSwap.SwapData[] calldata _swapData)
        internal
        returns (uint256)
    {
        uint256 nSwaps = _swapData.length;
        if (nSwaps == 0) revert NoSwapDataProvided();
        address finalTokenId = _swapData[_swapData.length - 1].receivingAssetId;
        uint256 swapBalance = LibAsset.getOwnBalance(finalTokenId);
        _executeSwaps(_lifiData, _swapData);
        swapBalance = LibAsset.getOwnBalance(finalTokenId) - swapBalance;
        if (swapBalance == 0) revert InvalidAmount();
        return swapBalance;
    }

    /// Private Methods ///

    /// @dev Executes swaps and checks that DEXs used are in the allowList
    /// @param _lifiData LiFi tracking data
    /// @param _swapData Array of data used to execute swaps
    function _executeSwaps(LiFiData memory _lifiData, LibSwap.SwapData[] calldata _swapData)
        internal
        noLeftovers(_swapData)
    {
        for (uint256 i = 0; i < _swapData.length; i++) {
            LibSwap.SwapData calldata currentSwapData = _swapData[i];
            if (
                !(ls.dexAllowlist[currentSwapData.approveTo] &&
                    ls.dexAllowlist[currentSwapData.callTo] &&
                    ls.dexFuncSignatureAllowList[bytes32(currentSwapData.callData[:8])])
            ) revert ContractCallNotAllowed();
            LibSwap.swap(_lifiData.transactionId, currentSwapData);
        }
    }

    /// @dev Fetches balances of tokens to be swapped before swapping.
    /// @param _swapData Array of data used to execute swaps
    /// @return uint256[] Array of token balances.
    function _fetchBalances(LibSwap.SwapData[] calldata _swapData) private view returns (uint256[] memory) {
        uint256 length = _swapData.length;
        uint256[] memory balances = new uint256[](length);
        for (uint256 i = 0; i < length; i++) balances[i] = LibAsset.getOwnBalance(_swapData[i].receivingAssetId);
        return balances;
    }
}


Vulnerability type: CWE-664