Vulnerability Details

The Distribution_init function in the Distribution smart contract is susceptible to a potential front-running vulnerability during initialization. Which can cause re-deployment of the proxy contract or in worst case. If deployer forgot to check the set parameters than parameters will be set according to attacker's interest.

The vulnerability is primarily associated with the transparency of the initialization process. The Distribution_init function initializes the contract and deploys pools using the provided parameters.

contracts/Distribution.sol#L54C5-L68C6

Impact

An attacker could monitor the Ethereum mempool for transactions deploying new instances of the smart contract. can cause re-deployment of the proxy contract or in worst case. If deployer forgot to check the set parameters than parameters will be set according to attacker's interest.

Recommendations

To mitigate the front-running vulnerability during initialization, consider implementing the following measures:
Add any access control mechanism to Distribution_init function. Like when deploying implementation contract add one immutable var. set deployer's address into that. Only that set address should be able to call Distribution_init initializer function.