Submission Details
Severity:
UpgradeBranch logic contract can be destroyed
Summary
UpgradeBranchcontract's functionality can be rendered inoperable and halt the project.
Vulnerability Details
According to openzeppelin documentation
[CAUTION]
* ====
* Avoid leaving a contract uninitialized.
*
* An uninitialized contract can be taken over by an attacker. This applies to both a proxy and its implementation
* contract, which may impact the proxy. To prevent the implementation contract from being used, you should invoke
* the {_disableInitializers} function in the constructor to automatically lock it when it is deployed:
*
* [.hljs-theme-light.nopadding]
* ```
* /// @custom:oz-upgrades-unsafe-allow constructor
* constructor() {
* _disableInitializers();
* }
* ```
* ====
*/
However, there is no such mitigation placed in constructor.
Impact
Attacker can takeover the contract and destroy it.
Tools Used
Manual
Recommendations
Add the mitigation suggested by OpenZeppelin in the contract.
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
UpgradeBranch lacks `_disableInitializers()` in constructor.
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,87821
USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.