60,000 USDC
Submission Details
Severity:
Upgradeable contract doesn't call `disableInitializers`
Summary
The codebase has a number of upgradeable contracts which use OpenZeppelin Initializable but don't have a constructor which calls _disableInitializers per the OpenZeppelin documentation.
Impact
Contract implementations could be initialized when this should not be possible.
Tools Used
Manual Review
Recommendations
Contracts meant to be upgreadable like Bridge.sol should implement disableInitializers in their constructor this way:
constructor() {
_disableInitializers();
}
Updates
Lead Judging Commences
n0kto 10 months ago
Submission Judgement Published Assigned finding tags:
finding-initialize-on-implementation
Likelyhood: Low/Medium Impact: Very low, the attacker can at most run the protocol on their side and lead a phishing campaign with an address deployed by Ark.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.