stake.link

Summary

SDLPoolPrimary.sol and SDLPoolSecondary.sol contracts are both upgradeable smart contracts and the initializer function on them can be front-run causing the contracts to have unintended initialization

Vulnerability Details

SDLPoolPrimary.sol and SDLPoolSecondary.sol contracts are both upgradeable smart contracts and the initializer function on them can be front-run causing the contracts to have unintended initialization

Impact

Not initializing the contracts on deployment and forgetting to initialize them would make it so any one can call the initialization function and initialize the contract with whatever values they pass in to the function and that would in return break the protocol.

Tools Used

Manual Review

Recommendations

The protocol should make sure to initialize the contracts on deployment so as to avoid forgetting to initialize them and leaving them open for anybody to initialize