Submission Details
Severity:
Initializers can be front-run
Summary
Initializers could be vulnerable to front-running attacks.
This might allow an attacker to set their own values, take ownership of the contract, or force a redeployment in the best-case scenario.
Be cautious of potential front-running risks in the following instances found in the code.
Vulnerability Details
File: contracts/Distribution.sol
54: function Distribution_init(
address depositToken_,
address l1Sender_,
Pool[] calldata poolsInfo_
) external initializer
File: contracts/L1Sender.sol
32: function L1Sender__init(
address distribution_,
RewardTokenConfig calldata rewardTokenConfig_,
DepositTokenConfig calldata depositTokenConfig_
) external initializer
File: contracts/L2MessageReceiver.sol
21: function L2MessageReceiver__init() external initializer
File: contracts/L2TokenReceiver.sol
23: function L2TokenReceiver__init(
address router_,
address nonfungiblePositionManager_,
SwapParams memory params_
) external initializer
Recommendations
Add restriction modifier to initializers
Updates
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.