60,000 USDC
Submission Details
Severity:
Missing `_disableInitializer` in Bridge Implementation Constructor
Vulnerability Details
The bridge contract does not disable initializer on the implementation contract, which means that the initialize function can be called by anyone for the implementation contract which might lead to unexpected behavior because the caller becomes the owner of the implementation contract.
Updates
Lead Judging Commences
n0kto about 1 year ago
Submission Judgement Published Assigned finding tags:
finding-initialize-on-implementation
Likelyhood: Low/Medium Impact: Very low, the attacker can at most run the protocol on their side and lead a phishing campaign with an address deployed by Ark.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.