Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unprotected initializer

emma77

Summary

Any account can call Rescuable::initializeOwnership before the contract is initialized.

Vulnerability Details

​
function initializeOwnership(address _newOwner) external { // @audit Is it properly protected?
if (owner() != address(0x0)) {
revert AlreadyInitialized();
}
​
_transferOwnership(_newOwner);
}

Impact

Any account can call initializeOwnership before the contract is initialized, this can lead to an exploit by an attacker

Tools Used

manual review

Recommendations

Make use of an access control mechanisms to restrict who can call initializeOwnership.

Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-Rescuable-initializeOwner-lack-access-control

Aside from `Rescuable.sol` being OOS, this is invalid based on codehawks guidelines regarding unprotected initializers. Additionally, this should be called concurrently when deploying a new proxy, but this submissions does not identify that particular issue of an uninitialized owner for proxy contracts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.