First Flight #9: Soulmate

Summary

The initVault() function is publicly accessible, which means that anyone can call it.

Vulnerability Details

The initVault() function is publicly accessible, which means that anyone can call it.

Impact

This poses a security risk because once the vault contracts are deployed, unauthorized actors could potentially deploy and initialize their own malicious airdrop or staking contracts.

Tools Used

Manual review

Recommendations

To mitigate this risk, the function should be restricted to only the contract owner or a designated role that has the authority to initialize the vault.