Submission Details
Severity:
Ownable not initialized
Summary
DOS due to Ownable not being initialized with msg.sender.
Vulnerability Details
The install submodules point to the latest version of the Openzeppelin/openzeppelin-contracts library, which since May 23 of 2023 the Ownable.sol went through breaking changes, to which the ProxyFactory.sol hasn't adapted.
Impact
Due to _owner not being initialized, the contract administrator lacks access to setContest (total contract business logic DOS), deployProxyAndDistributeByOwner and distributeByOwner.
Tools Used
Manual review and Foundry.
Recommendations
File: src/ProxyFactory.sol
- 81: constructor(address[] memory _whitelistedTokens) EIP712("ProxyFactory", "1") Ownable() { // @audit Ownable not initialized
+ 81: constructor(address[] memory _whitelistedTokens) EIP712("ProxyFactory", "1") Ownable(msg.sender) {
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477
USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.