First Flight #3: Thunder Loan

Sy

Initialization can be front-run

Vulnerability Details

The initialize() functions below are not called by another contract atomically after the contract is deployed, so it's possible for a malicious user to call initialize() which, if it's noticed in time, would require the project to re-deploy the contract in order to properly initialize.

Lines of code

Total -> 2

139, 139

Impact

A malicious user can call this to take ownership of this contract.

Tools Used

Manual review

Recommended Mitigation Steps

Consider creating a factory contract, which will new and initialize() each contract atomically.