The Standard

Summary

SmartVaultManagerV5 contract is upgradeable that utilises initialize function but does not provide any protection to the method from front running.

Vulnerability Details

Uninitialized implementation in contract can be taken over by an attacker with initialize function. SmartVaultManagerV5 contract is Upgradeable but does not have constructors which makes call to the _disableInitializers.

Impact

Implementation contracts should not remain uninitalized. Uninitalization can lead to attack where a malicious attacker can take over control of contract and require redeploying of contracts which can be costly for the protocol.
Ensuring prevention of initialization by an attacker which will have a direct impact on the contract as the implementation contract’s constructor should have _disableInitializers() method .

Tools Used

Manual code review

Recommendations

Add constructor to SmartVaultManagerV5 contract that calls _disableInitializers() for preventing the possibility of front-running the initialise contract.