Submission Details
Severity:
A malicious bootstrap can render any Nexus account re-initializable by an attacker, allowing them to set any malicious validator or executor on the account. This would enable the attacker to drain all funds from the account
Updates
Lead Judging Commences
0xnevi 10 months ago
Submission Judgement Published Reason: Other
Assigned finding tags:
finding-front-running-initializeAccount
Invalid, - Checked [here](https://github.com/rhinestonewtf/sentinellist/blob/6dff696f39fb55bfdde9581544d788932f145e47/src/SentinelList.sol#L30-L32) based on `SentinelListLib` used as dependencies as seen [here](https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/interfaces/base/IStorage.sol#L34-L35). Contract cannot be reinitialized - front-running initializers invalid per [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid)
Prize pool breakdown
Total prize
30,000 USDC
nSLOC
1,43321 USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.