The Standard

Summary

Upgradeable contract state variables are not set using the initialize function.

Vulnerability Details

As per OZ’s docs upgradeable contract initialize function work in place of constructor to assign values to state variable which is not followed in the contract of SmartVaultManagerV5.
This initialize() method is call in same txn of contract deployed or immediately called afterwards to set state variables as a security measure for upgradeable contracts.

Impact

State variables will remain un-initialise and all functions mainly the mint function will remain useless till all values are assigned separately.

Tools Used

Oz’s Docs

Recommendations

The recommendation is made to initialise all state variables declare inside the SmartVaultManagerV5 contract inside the initialize function.