stake.link

Summary

The initialize function within SDLPoolPrimary.sol lacks access control measures and can be invoked multiple times.

Vulnerability Details

The reinitialization possibility arises due to the function using reinitializer(2) instead of an initializer flag. This allows the function to be rerun multiple times, potentially impacting critical variables.
For instance, we call __SDLPoolBase_init() in initialize() function, responsible for initializing __RewardsPoolController_init(), which in turn initializes the owner using __Ownable_init(). Such reinitializations can lead to significant consequences.

Impact

Lines of code:

Tools Used

Manual Analysis

Recommendations

To mitigate this issue, it's advisable to use the modifier initializer and introduce access control to safeguard against potential front-running attacks. This would prevent the function from being re-executed, ensuring more secure initialization procedures.