Tadle

Github

• https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L25

Summary

SystemConfig:initialize function lacks the initializer modifier. This missing modifier allows the function to be called multiple times, which could lead to reinitialization attacks or accidental misconfigurations. Such vulnerabilities could result in the loss of system control or incorrect fee settings, posing significant risks to the contract's security and functionality.

Vulnerability Details

The SystemConfig contract contains an initialize function intended to set the initial values for basePlatformFeeRate and baseReferralRate. However, the function lacks the initializer modifier, which is crucial in preventing multiple calls to the function. Without the initializer modifier, owner could call the initialize function again after the contract has already been deployed and initialized. This allows to modify critical parameters such as basePlatformFeeRate and baseReferralRate, potentially destabilizing the entire system. The absence of protection against multiple initializations could lead to accidental reinitializations by the contract owner or other authorized users. This could result in incorrect fee settings or other unintended consequences, affecting the contract's performance and security.

Impact

Multiple initializations could cause inconsistent state within the contract, leading to errors in fee calculations and other operations.

Tools Used

Manual Review

Recommendations

Implement the initializer modifier from OpenZeppelin's Initializable contract to ensure the initialize function can only be called once. This prevents reinitialization and secures the contract against related attacks.