Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Netiher `SDT Operators` cant upgrade their vaults nor `OperatorVCS` from v1 to v2

bugHunters69

Vulnerability Details

If an already existing stake.link v1 OperatorVault desires to use stake.link for v2 it will revert on its upgrade, whereas new operators that join stake.link will create their new contract successfully. Furthermore OperatorVCS contract upgrade will also fail.

The reason is because of the reinitializer(3) modifier in the initialize() functions.

Proof Of Concept

If you go the official OperatorVCS for v1 in Etherscan here you will see that the proxy _initialized variable has the value 3.

If you use getVaults() and go the first vault address as example (see here) you will also see that Vaults have _initialized == 3.

To read the private state from Etherscan you can use this browser extension BlockSec Meta Suits.

Now this is the reinitializer() code used by the system:

modifier reinitializer(uint8 version) {
// 👁️🔴⏬ `_initialized < version`, this condition is not met as `3 < 3 == false`
@> require(!_initializing && _initialized < version, "Initializable: contract is already initialized");
// code...
}

Impact

Previous operators that want to migrate to v2 will not be able to do so. And the upgrade for the OperatorVCS will not be possible either.

Recommendations

Reinitializer should be reinitializer(4) in both OperatorVaults and OperatorVCS.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Some contracts will not be initialized due to an incorrect `reinitializer` versions used

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.