Summary

The reSDLTokenBridge, ccipController, rewardsInitiator address variables can be set in separate functions that have onlyOwner modifier. However they are not set in the constructor or in the function that is called upon deployment.

Vulnerability Details

The fact that these variables are not set and hold address(0) by default, means that the contracts will not function as desired. As mentioned above, they can be set in separate functions by the owner, but still there can be a time window when the owner will not realize he forgot to call these functions right after deployment.

Impact

Variables will be = address(0) and the contracts will not function properly.

Tools Used

Manual Review

Recommendations

Set the variables in the constructor or in the function that initializes the contract.