Sparkn

Summary

No Access Control in Constructor Vulnerability in Proxy Contract

Vulnerability Details

The vulnerability stems from the absence of access control in the constructor of the Proxy contract. As a result, any address can deploy a Proxy instance with any implementation address, potentially leading to unauthorized deployments and unintended behavior.

Impact

Unauthorized or malicious actors could deploy Proxy instances with arbitrary implementation addresses, potentially compromising the security and functionality of the contract.

Tools Used

Manual code review and analysis of the access control mechanisms in the Proxy contract's constructor.

Recommendations

To mitigate this vulnerability, consider the following recommendations:

1. Access Control in Constructor: Implement access control checks in the constructor to restrict its execution to authorized addresses only.

2. Access Restriction Logic: Determine which addresses should have the ability to deploy Proxy instances and implement logic to enforce access restrictions.

3. Documentation: Clearly document the intended usage of the constructor and its access control mechanisms.