`SmartVaultManagerV5.sol` is lacking constructor and `_disableInitializers();`
Summary
There is no constructor in SmartVaultManagerV5.sol and so there is no _disableInitializers(); function being called.
Vulnerability Details
As stated in the OpenZeppelin Docs:
Initializing the Implementation Contract Do not leave an implementation contract uninitialized. An uninitialized implementation contract can be taken over by an attacker, which may impact the proxy. To prevent the implementation contract from being used, you should invoke the _disableInitializers function in the constructor to automatically lock it when it is deployed:
https://docs.openzeppelin.com/upgrades-plugins/1.x/writing-upgradeable#use-upgradeable-libraries
Impact
Contract can be hijacked by calling initialize() function.
Tools Used
Manual review
Recommendations
Add :
Lead Judging Commences
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.