Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

The `initializeOwnership` function is not protected, Anyone can call it and win ownership of the contracts.

mikebello

Summary

The function initializeOwnership is not protected, so anyone can call it front-running the protocol call and win ownership of the contracts.

Vulnerability Details

The Rescuable contract is a base contract that is inherited in all the core contracts of the protocol, this contract implements basic functionality like pausing, transfer ownership, tokens transfer, and tokens rescue for the 5 core contracts CapitalPool, DeliveryPlace, PreMarkets, SystemConfig and TokenManager .

The Rescuable contract implements a function called initializeOwnership that is meant to be used by the owner of the contracts to transfer the ownership to another address, but this function doesn't implement the onlyOwner modifier, allowing anyone to call it and change the ownership of the 5 core contracts to any address.

So after deployment of the contracts, an attacker can front-run the owner calling the initializeOwnership function and gaining ownership of the contracts.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/utils/Rescuable.sol#L33-L39

function initializeOwnership(address _newOwner) external {
if (owner() != address(0x0)) {
revert AlreadyInitialized();
}
​
_transferOwnership(_newOwner);
}

Impact

An attacker can steal the ownership of the 5 core contracts of the protocol.

Tools Used

Manual Code Review

Recommendations

Implement the onlyOwner modifier in the initializeOwnership function to avoid the risk of an attacker stealing the ownership of the contracts

Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-Rescuable-initializeOwner-lack-access-control

Aside from `Rescuable.sol` being OOS, this is invalid based on codehawks guidelines regarding unprotected initializers. Additionally, this should be called concurrently when deploying a new proxy, but this submissions does not identify that particular issue of an uninitialized owner for proxy contracts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.