DittoETH

Summary

Diamond upgrade proposition can be falsified
Malicious or compromised admins can send any _init and _calldata at their will. This is dangerous as they will be used for a delegatecall operation. An attacker can execute a delegatecall to steal funds or selfdestruct the system.

Vulnerability Details

• Malicious can create an empty payload for _init and _calldata.

• Then the malicious executes the update with _init pointing to a malicious contract, stealing funds from the system.

Impact

Diamonds will be upgraded by admin. Malicious or compromised admins can exploit the contract in any way of their choice.

Tools Used

Recommendations

[Refer to the same bug as well as how to redeploy LibDiamond.diamondCut](Refer to the same bug as well as how to redeploy LibDiamond.diamondCut)