Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Initialize() can be called multiple times.

parkeqpapa

Vulnerability Details

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L43-L45

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/SystemConfig.sol#L25-L31

Impact

Without the initializer modifier there is a risk that the initialize() function could be called several times, this could disrupt protocol functionality.

Paste this test to PreMarkets.t.sol

function test_can_initialize() public {
vm.startPrank(user1);
systemConfig.initialize(basePlatformFeeRate, baseReferralRate);
tokenManager.initialize(address(weth9));
​
systemConfig.initialize(basePlatformFeeRate, baseReferralRate);
tokenManager.initialize(address(mockUSDCToken));
​
}

Tools Used

manual review.

Recommendations

Implement the initializer modifier in order to make the initialize() function call only when neccesary.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-Rescuable-initializeOwner-lack-access-control

Aside from `Rescuable.sol` being OOS, this is invalid based on codehawks guidelines regarding unprotected initializers. Additionally, this should be called concurrently when deploying a new proxy, but this submissions does not identify that particular issue of an uninitialized owner for proxy contracts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.