Sparkn

Summary

The ProxyFactory contract uses an incorrect version of the Ownable library, which can potentially lead to the malfunction of all functions that rely on the onlyOwner modifier.

Vulnerability Details

The current implementation is using an non-upgradeable version of the Ownbale library instead of the upgradeable version:

@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol.

A regular, non-upgradeable Ownbale library will make the deployer the default owner in the constructor. Due to a requirement of the proxy-based upgradeability system, no constructors can be used in upgradeable contracts. Therefore, there will be no owner when the contract is deployed as a proxy contract.

Impact

Malicious actors could exploit this vulnerability to manipulate contract behavior or drain funds.

Tools Used

Manual Review

Recommendations

Use

@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol