stake.link

Summary

The SDLPoolSecondary contract implements a simple initialization system that can be abused by any user.

Vulnerability Details

The main concern revolves around the absence of protection for the init function. Any user has the capability to call init without restrictions.

Impact

Exploit Scenario
Alice deploys the SDLPoolSecondary contract. Eve is monitoring the blockchain transactions and notices that Alice has started the deployment. Before Alice can perform any other transaction, Eve calls init with higher fees to front run the initialize transaction, so Alice transaction is reverted .

Tools Used

Manual Analysis

Recommendations

To enhance security, it's advisable to implement a control mechanism that restricts initialize() to only be callable by the Deployer Contract or EOA. This limitation helps prevent unauthorized execution of the initialization function, ensuring it can only be invoked by specific authorized entities.