_disableInitializers is missing in Bridge’s constructor
Summary
disableinitializers is not called in Starklane’s constructor
Vulnerability Details
An uninitialized contract can be taken over by an attacker. This applies to both a proxy and its implementation contract, which may impact the proxy. But in the case of the implementation contract, a disableinitializers() is necessary to be called in the constructor. This is because when the Bridge contract is deployed and initialized, the initialize method on the newly created proxy's implementation contract is never called. As such, anyone can call that method and pass in whatever values they want as arguments.
Impact
An attacker can call Bridge::initialize and pass arbitrary arguments
Tools Used
Manual Review
Recommendations
Add the following constructor:
Lead Judging Commences
finding-initialize-on-implementation
Likelyhood: Low/Medium Impact: Very low, the attacker can at most run the protocol on their side and lead a phishing campaign with an address deployed by Ark.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.