Zaros Part 1

Description

Several branches need initialization to function correctly. As deployment scripts are not in scope and are due for rework, it's uncertain how the contract will be deployed and initialized.

If the contract is deployed with multiple calls to the upgrade function to add branches, initializer accesses the same struct storage due to EIP7201. The first initializable function sets the boolean to true, preventing any subsequent branch from passing the initializer modifier.

urthermore, deploying the entire contract at once using initializer ultiple times during the constructor is not the expected behavior according to OpenZeppelin documentation.

The comment in the Initializable contract:

Risk

Likelyhood: Low

• If the contract does not deploy the branches all at once, initialization will fail except for the first one.

According to OpenZeppelin comment, this is not a behavior to use in production.

Impact: Low

• Initialization will fail and the protocol will need to deploy again or redeploy the other branches with the reinitializer modifier.

Recommended Mitigation

If deployed separately, use reinitializer(x) with x being the order number where functions are called. If all the branches are deployed at the same time, use reinitializer(1) modifier on one function and onlyInitializing modifier on other functions to initialize.