Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Ownership Initialization Issue in `GlobalConfigurationBranch`

tigerfrake

Summary

The GlobalConfigurationBranch contract does not directly initialize the OwnableUpgradeable contract, which is necessary for the ownership functions to work correctly. The comment suggests that this initialization happens in UpgradeBranch, but there is no direct connection between the two contracts.

Vulnerability Details

The comment in GlobalConfigurationBranch indicates that OwnableUpgradeable is initialized in UpgradeBranch.

contract GlobalConfigurationBranch is Initializable, OwnableUpgradeable {
// ...
>> /// @dev The Ownable contract is initialized at the UpgradeBranch.
​
function initialize(address tradingAccountToken, address usdToken) external initializer {
GlobalConfiguration.Data storage globalConfiguration = GlobalConfiguration.load();
globalConfiguration.tradingAccountToken = tradingAccountToken;
globalConfiguration.usdToken = usdToken;
}
}

However, there is no inheritance or direct interaction between these contracts. Here is UpgradeBranch:

contract UpgradeBranch is Initializable, OwnableUpgradeable {
// ...
function initialize(address owner) external initializer {
__Ownable_init(owner);
}
}

As seen, UpgradeBranch indeed initializes OwnableUpgradeable and sets the owner but just within it. However, GlobalConfigurationBranch is not linked to this in any way.

Impact

Without proper initialization of OwnableUpgradeable, the onlyOwner modifier and other ownership-related functions in GlobalConfigurationBranch will not function correctly.

Tools Used

Manual Review

Recommendations

GlobalConfigurationBranch should inherit from UpgradeBranch to leverage the ownership initialization.

- import { Initializable } from "@openzeppelin-upgradeable/proxy/utils/Initializable.sol";
- import { OwnableUpgradeable } from "@openzeppelin-upgradeable/access/OwnableUpgradeable.sol";
+ import { UpgradeBranch } from "@zaros/tree-proxy/branches/UpgradeBranch.sol";
​
- contract GlobalConfigurationBranch is Initializable, OwnableUpgradeable {
+ contract GlobalConfigurationBranch is UpgradeBranch {
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.