Sparkn

Summary

The function setContract is limited to be callable only by the owner. However, a potential vulnerability exists where the implementation address may inadvertently be set to an unintended address. While there is a check to ensure that the address isn't zero, it lacks a check to verify whether the address is indeed a contract address.

Vulnerability Details

• Function affected: setContract

• The function does not verify if the provided address is an actual contract address. Mistakenly setting the address to a non-contract address can lead to undesired behavior or potential loss of funds.

Impact

Suppose an incorrect or malicious address is mistakenly set as the implementation. In that case, all calls to the proxy might either fail or result in unintended consequences, potentially compromising the security and functionality of the contract.

Tools Used

Manual Review

Recommendations

• Use OpenZeppelin's isContract function.

• Alternatively, implement your own function to check if an address
  is a contract, as discussed above.