Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`initialize` should not be able to call again

pina

Summary

Without the `initializer` modifier, there is a risk that the initialization function can be called multiple times.

Vulnerability Details

Several contracts have the same issue:

function initialize(address _wrappedNativeToken) external onlyOwner {
wrappedNativeToken = _wrappedNativeToken;
}

TokenManager.sol

function initialize(
uint256 _basePlatformFeeRate,
uint256 _baseReferralRate
) external onlyOwner {
basePlatformFeeRate = _basePlatformFeeRate;
baseReferralRate = _baseReferralRate;
}

SystemConfig.sol

Impact

The contracts can be initializer again

Tools Used

Manual code review

Recommendations

Always use the `initializer` modifier for initialization functions in proxied contracts and ensure they're called once during deployment.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

[invalid] finding-Rescuable-initializeOwner-lack-access-control

Aside from `Rescuable.sol` being OOS, this is invalid based on codehawks guidelines regarding unprotected initializers. Additionally, this should be called concurrently when deploying a new proxy, but this submissions does not identify that particular issue of an uninitialized owner for proxy contracts

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.