Submission Details
Severity:
All the `initialize` function are unprotected and can be front run
Summary
A bad actor can front run the initialize function of all the contract and setting faulty values.
Vulnerability Details
function initialize(
address _token,
address _stakingPool,
address _sdlPool,
uint128 _queueDepositMin,
uint128 _queueDepositMax
@> ) public initializer {
.
.
.
}
As all the initialize function are unprotected a bad actor can front run the initialization process and can set faulty values.
Impact
The contract will be unusable and needs to redeploy again.
Tools Used
Manual Review
Recommendations
Protect the initialize by adding onlyOwner modifier
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020 USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.