The Standard

The Standard
DeFiHardhat
20,000 USDC
View results
Submission Details
Severity: medium
Invalid

SmartVaultManagerV5.sol::initialize() function is empty and does not perform any initialization logic

Summary

SmartVaultManagerV5.sol::initialize() function is empty and does not perform any initialization logic.

Vulnerability Details

SmartVaultManagerV5.sol::initialize() function is empty and does not perform any initialization logic. In an upgradeable contract, you would typically use the initialize() function to replace the constructor and set up any initial state or configuration for the contract but this is empty.
Usually, an initialize() function will have parameters that are used to set initial values for the contract's state variables. In this contract, there are several state variables (like protocol, liquidator, euros, etc.) that should ideally be set upon initialization to ensure the contract starts with a valid state.

Impact

'OwnableUpgradeable' is designed to provide ownership functionality to the contract, allowing certain functions to be restricted to be callable only by the contract owner. If the 'OwnableUpgradeable' initializer is not called, the owner of the contract might not be set, leaving the contract without a clear owner. This can result in access control functionality not working properly.
With an uninitialized owner, all functions that are guarded by the onlyOwner modifier would become inaccessible because the check to see if msg.sender is the owner would fail. No address would be recognized as the owner, effectively locking those functions.

Tools Used

Manual Review

Recommendations

the initialize function should be implemented with appropriate logic to initialize all necessary state variables and call the initializer functions of any inherited contracts. Additionally, it should be protected with the initializer modifier to ensure it can only be executed once.

address _protocol,
address _liquidator,
address _euros,
// any other parameters needed for initialization
) public initializer {
OwnableUpgradeable.__Ownable_init();
ERC721Upgradeable.__ERC721_init("Euros", "EUR");
// set initial values for state variables
protocol = _protocol;
liquidator = _liquidator;
euros = _euros;
// initialize other state variables as required
}```
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

uninitialized-variables

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.