Submission Details
Severity:
SmartVaultManagerV5 leaves contract uninitialized
Summary
Avoid leaving a contract uninitialized.
Vulnerability Details
Missing constructor to disable initializer. The implementation contract from being used, you should invoke the _disableInitializers function in the constructor to automatically lock it when it is deployed
Impact
An uninitialized contract can be taken over by an attacker. This applies to both a proxy and its implementation contract, which may impact the proxy.
Tools Used
Manual Review
Recommendations
Include the following:
/// @custom:oz-upgrades-unsafe-allow constructor
constructor() {
_disableInitializers();
}
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
informational/invalid
thedoctor
over 1 year ago
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.