First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

initialize() missing address check

kiteweb3

Summary

In ThunderLoan::initialize() and ThunderLoanUpgraded::initialize() are missing the addresseses check.

Vulnerability Details

//ThunderLoan.sol
​
function initialize(address tswapAddress) external initializer {
@> __Ownable_init();
__UUPSUpgradeable_init();
@> __Oracle_init(tswapAddress);
s_feePrecision = 1e18;
s_flashLoanFee = 3e15; // 0.3% ETH fee
}
//ThunderLoanUpgraded.sol
​
function initialize(address tswapAddress) external initializer {
@> __Ownable_init();
__UUPSUpgradeable_init();
@> __Oracle_init(tswapAddress);
s_flashLoanFee = 3e15; // 0.3% ETH fee
}

Impact

In both the ThunderLoan::initialize() and ThunderLoanUpgraded::initialize() functions, the absence of addresses verification presents a vulnerability. It's important to implement adequate checks; otherwise, errors within the constructor can necessitate redeployment of the contract.

The initialize() function to be called by any entity when the contract remains uninitialized. If an unauthorized entity executes this function, they gain full authority due to the __Ownable_init() function. Moreover, there's a lack of validation for 0 address inputs in the initialize() function, which should be enforced for proper definition and security.

Tools Used

Manual review

Recommendations

function initialize(address tswapAddress) external initializer {
+ if (msg.sender != DEPLOYER_ADDRESS) {
+ revert NotDeployer();
+ }
​
+ if (address(tswapAddress) == address(0)) {
+ revert ZeroAddressNotAllowed();
+ }
​
__Ownable_init();
__UUPSUpgradeable_init();
__Oracle_init(tswapAddress);
s_flashLoanFee = 3e15; // 0.3% ETH fee
}
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Front-running initializers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.