Tadle

Summary

Rescuable.sol is Ownable contract so by default the deployer is assigned as its initial owner. The function initializeOwnership(address _newOwner) does not account for that hence, it will always revert when called.

Vulnerability Details

All core contracts in the protocol inherit from Rescuable.sol to be able to rescue user funds if needed.

Rescuable.sol in turn inherits from Ownable.sol and hence it has an initial owner which is the deployer of the contract. However, the initializeOwnership() implementation assumes the contract has no owner

Therefore, Any attempt to call this function will revert leaving the contract unable to change the ownership when needed this will lead to paralyzing all onlyOwner functionality of the protocol.

Impact

The impact is totally dependent on:

• The initial owner condition ( available or not)

• The protocol is already deployed or not.
  The impact can range from Low ( if the initial owner is easy to access or the protocol is still in deployment stage)
  to High (if the initial owner is not reachable and the protocol already in high demand or high risk)

Tools Used

Manual review

Recommendations

Use onlyOwner modifier to ensure that no one other than the initial owner can call the function and make the illustrated changes below

And -of course - making the owner a multi-sig account will omit the danger of an unavailable owner.