The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Initializers with no access control can be frontrunnable.

DarkTower

Summary

All contract initializers were missing access controls, allowing any user to initialize the contract. Leaving functions vulnerable to frontrunning attackers.

Vulnerability Details

Initializers could be front-run, allowing an attacker to either set their own values, take ownership of the contract, and in the best case forcing a re-deployment.

Context: SmartVaultManagerV5::initialize

function initialize() initializer public {}

Context: utils/SmartVaultManager::initialize

function initialize() public initializer {
__ERC721_init("The Standard Smart Vault Manager", "TSVAULTMAN");
​
__Ownable_init();

Impact

Attacker can either set their own values, take ownership of the contract, and in the best case forcing a re-deployment.

Tools

Manual Review, 4naly3er

Recommendation

Provide access control in initialize function.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.