Zaros Part 1

Summary

The UpgradeBranch contract is vulnerable to reinitialization attacks due to the absence of the _disableInitializers() function call. This allows an attacker to reinitialize the contract, potentially changing the owner and gaining unauthorized control over the contract's upgrade process.

Vulnerability Details

The UpgradeBranch contract inherits the OwnableUpgradeable and Initializable contracts but fails to call the _disableInitializers function as seen in the following code;

Impact

An attacker could re-initialize the contract, setting themselves as the owner and gaining control over the contract's functionality, therefore, critical functions protected by onlyOwner for example _authorizeUpgrade() function could be exploited by the attacker.

Tools Used

Manual Review

Recommendations

Ensure to invoke _disableInitializers function within the contract's constructor to prevent the implementation contract from being initialized.