Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Reinitialization Vulnerability

0bingo76

Summary

The initialize function can be called multiple times, allowing the wrappedNativeToken address to be changed after initial setup.

Vulnerability Details

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L43-L45

function initialize(address _wrappedNativeToken) external onlyOwner {
wrappedNativeToken = _wrappedNativeToken;
}

This function lacks a mechanism to prevent multiple initializations, allowing the wrappedNativeToken to be changed at any time by the owner.

Impact

An attacker who gains owner privileges could change the wrappedNativeToken to a malicious contract, potentially leading to fund theft or contract lockup.

Real-world Example

The Parity Multisig Wallet hack in 2017 resulted from a reinitialization vulnerability, leading to the loss of $31 million worth of Ether.

Tools Used

Manual code review

Recommendations

Implement a one-time initialization check:

bool private initialized;
function initialize(address _wrappedNativeToken) external onlyOwner {
require(!initialized, "Already initialized");
require(_wrappedNativeToken != address(0), "Invalid address");
wrappedNativeToken = _wrappedNativeToken;
initialized = true;
}

Consider using OpenZeppelin's Initializable contract for a standardized initialization approach.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-Admin-Errors-Malicious

The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.