Summary

The UUPSOwnableProxied contract does not invoke the _disableInitializers() function within its constructor.

This omission can lead to unauthorized initialization of the implementation contract, potentially allowing malicious actors to take ownership and execute destructive actions.

Vulnerability Details

The UUPSOwnableProxied contract does not invoke the _disableInitializers() function within its constructor.

Impact

Malicious actors can initialize the implementation contract and set themselves as the owner.

As the owner, they can call onlyOwner functions, including potentially destructive ones via delegatecall (e.g., triggering selfdestruct).

If selfdestruct is called on the implementation, it could lock assets in the proxy contract indefinitely.

Tools Used

manual review

Recommendations

1. Add Constructor with _disableInitializers():

   /// @custom:oz-upgrades-unsafe-allow constructor

   constructor() {

   _disableInitializers();

   }