Submission Details
Severity:
Upgradable contracts need a constructor to lock the implementation contract when it is deployed
Summary
Upgradable contracts need a constructor to lock the implementation contract when it is deployed
Vulnerability Details
An uninitialized contract can be taken over by an attacker. For an upgradable contract, this applies to both the proxy and its implementation contract, which may impact the proxy. To prevent the implementation contract from being used, we should trigger the initialization in the constructor to automatically lock it when it is deployed. For contracts that inherit Initializable, the _disableInitializers() function is suggested to do this job
Impact
Instances (1):
File: contracts/core/sdlPool/base/SDLPool.sol
15: contract SDLPool is RewardsPoolController, IERC721Upgradeable, IERC721MetadataUpgradeable {
Tools Used
Recommendations
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.