Submission Details
Severity:
Incorrect reinitializer version used
Summary
In OperatorVCS and OperatorVault contracts, version 3 is used as reinitialization, which is incorrect.
Currently deployed contracts have version 3 already so reinitialization will revert.
Vulnerability Details
Here's code snippets of initialize function of OperatorVCS and OperatorVault contracts:
// OperatorVault
function initialize(
address _token,
address _vaultController,
address _stakeController,
address _rewardsController,
address _pfAlertsController,
address _operator,
address _rewardsReceiver
) public reinitializer(3) {
...
}
// OperatorVCS
function initialize(
address _token,
address _stakingPool,
address _stakeController,
address _vaultImplementation,
Fee[] memory _fees,
uint256 _maxDepositSizeBP,
uint256 _vaultMaxDeposits,
uint256 _operatorRewardPercentage,
address _vaultDepositController
) public reinitializer(3) {
...
}
As shown from the snippet, it uses reinitializer(3) to set current version to 3.
However, currently deployed contracts of VCS and Vault contracts have version 3.
As a result, reinitialization reverts
Impact
Failure of contracts upgrade
Tools Used
Manual Review
Recommendations
Use another version, probably 4.
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Some contracts will not be initialized due to an incorrect `reinitializer` versions used
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020 USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.