First Flight #19: Mondrian Wallet v2
First Flight #19
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

It's not necessary `MondrianWallet2` inherit `Initializable`

0xjoaovictor

Summary

In the MondrianWallet2 it not necessary inherit and use the Initializable contract.

Vulnerability Details

MondrianWallet2 will be have a unecessary inheritance of Initializable because the UUPSUpgradeable inheritance already have Initializable inheritance.

In the lib/openzeppelin-contracts-upgradeable/contracts/proxy/utils/UUPSUpgradeable.sol:

abstract contract UUPSUpgradeable is Initializable, IERC1822Proxiable {

Impact

MondrianWallet2 will be have unecessary inheritance because.

Tools Used

Solidity and Foundry

Proof Of Concept

Add the following code in the test/ModrianWallet2Test.t.sol:

function testZkDontNeedInitializableInheritance() public {
// First: remove `Initializable` inheritance and import in the `MondrianWallet2.sol`
​
// Arrange
MondrianWallet2 newImplementation = new MondrianWallet2();
​
// Act
vm.prank(ANVIL_DEFAULT_ACCOUNT);
UUPSUpgradeable(address(mondrianWallet)).upgradeToAndCall(address(newImplementation), bytes(""));
}

Run: forge test --zksync --system-mode=true --match-test testZkDontNeedInitializableInheritance -vvv

Recommendations

In the MondrianWallet2 you should remove the import and inheritance of Initializable:

// OZ Imports
import {MessageHashUtils} from "@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol";
import {ECDSA} from "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
- import {Initializable} from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
​
/**
* @title MondrianWallet2
* @notice Its upgradable! So there shouldn't be any issues because we can just upgrade!... right?
*/
- contract MondrianWallet2 is IAccount, Initializable, OwnableUpgradeable, UUPSUpgradeable {
+ contract MondrianWallet2 is IAccount, OwnableUpgradeable, UUPSUpgradeable {
Updates

Lead Judging Commences

bube Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.