The Standard

Summary

The SmartVaultManagerV5 contract inherits ERC721Upgradeable & OwnableUpgradeable contracts but does not invoke their individual initialzers during its own initialization. Due to which the state of ERC721Upgradeable & OwnableUpgradeable contracts remain uninitialized.

Vulnerability Details

Smart Vault Manager contract manage vault deployments, controls admin data which dictates behavior of Smart Vaults e.g. fee rates, collateral rates, dependency addresses, managed by The Standard.

SmartVaultManagerV5 implementation:

Importantly, it has no constructor and empty initializer. The issue is that when using upgradeable contracts, it is important to implement an initializer which will call the base contract's initializers in turn.

Since Pool skips the __Ownable_init initialization call, this logic is skipped:

Therefore, the contract owner stays zero initialized, and this means any use of onlyOwner() will always revert.

List of functions that will always throw:

• setMintFeeRate

• setBurnFeeRate

• setSwapFeeRate

• setWethAddress

• setSwapRouter2

• setNFTMetadataGenerator

• setSmartVaultDeployer

• setProtocolAddress

• setLiquidatorAddress

[!NOTE]
In addition, the ERC721 name and symbol will remain uninitialized, but there will be no impact except for integration issues.

Impact

SmartVaultManagerV5 is unusable as most of it's functions will throw.

Tools Used

Manual review

Recommendations

Consider initializing the ERC721Upgradeable & OwnableUpgradeable contracts in SmartVaultManagerV5.initialize function as follow: