The Standard

Summary

The initialize() functions are not protected by a modifier, which allow attackers to call this function once the contract is deployed through the proxy.

Vulnerability Details

function initialize() initializer public {}

Impact

Malicious users can front run the smart vault creating forcing the deployers to redeploy. The process can be repeated, which costs the malicious user less than it would the protocol owners, potentially unnecessarily draining funds from the development team.

Tools Used

Manual Code Review

Recommendations

Consider adding modifiers to protect this function or create a contract that both deploy the project and initialize it on the same transaction.