Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unprotected initializer

emma77

Summary

Rescuable::initializeOwnership function does not have an assess modifier this exposes the function/protocol to any attacker to exploit

Vulnerability Details

initializeOwnership function does not have a modifier

​
@> function initializeOwnership(address _newOwner) external { // @audit is not protected
if (owner() != address(0x0)) {
revert AlreadyInitialized();
}
​
_transferOwnership(_newOwner);
}

Impact

exposes the function/protocol to any attacker to exploit

Tools Used

manual review

Recommendations

Consider protecting the initializer functions with modifiers.

Updates

Lead Judging Commences

0xnevi Lead Judge
12 months ago
0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-Rescuable-initializeOwner-lack-access-control

Aside from `Rescuable.sol` being OOS, this is invalid based on codehawks guidelines regarding unprotected initializers. Additionally, this should be called concurrently when deploying a new proxy, but this submissions does not identify that particular issue of an uninitialized owner for proxy contracts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.