Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

unprotected initializer in oos conntract

0xkrkba

Summary

Vulnerability Details

the Rescuable.sol contract is out of scope but any bug in it will effect the protocol so,

Rescuable::initializeOwnership

function initializeOwnership(address _newOwner) external {
if (owner() != address(0x0)) {
revert AlreadyInitialized();
}
​
_transferOwnership(_newOwner);
}
​

is unprotected initializer, it can be called only once and only check that if the owner is initialized or not,

but it doesnt check the caller.

Impact

attacker can set ownership to himself

Tools Used

Recommendations

restrict this function to onlyOwner..

Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-Rescuable-initializeOwner-lack-access-control

Aside from `Rescuable.sol` being OOS, this is invalid based on codehawks guidelines regarding unprotected initializers. Additionally, this should be called concurrently when deploying a new proxy, but this submissions does not identify that particular issue of an uninitialized owner for proxy contracts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!