Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of admin initialization in Adminable contract

ghufranhassan1

Summary

The Adminable contract does not initialize the admin variable, which can lead to potential misconfiguration if not properly handled

Vulnerability Details

The admin variable is declared but not initialized in the Adminable contract. If a derived contract does not set the admin during deployment, it defaults to the zero address (address(0)). This can result in the contract being deployed without a valid admin, leading to a loss of control over admin functions for e.g. transfer admin function

Impact

The contract may become unmanageable if deployed without setting a valid admin, preventing any critical administrative actions from being taken.

Tools Used

Manual Review

Recommendations

Added constructor and check for the zero address in the adminable contract.

// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity >=0.8.22;
​
import { IAdminable } from "../interfaces/IAdminable.sol";
import { Errors } from "../libraries/Errors.sol";
​
/// @title Adminable
/// @notice See the documentation in {IAdminable}.
abstract contract Adminable is IAdminable {
​
constructor() {
admin = msg.sender; // Set the deployer as the initial admin
require(admin != address(0), "Admin cannot be the zero address");
}
​
/*//////////////////////////////////////////////////////////////////////////
STATE VARIABLES
//////////////////////////////////////////////////////////////////////////*/
​
/// @inheritdoc IAdminable
address public override admin;
​
/*//////////////////////////////////////////////////////////////////////////
MODIFIERS
//////////////////////////////////////////////////////////////////////////*/
​
/// @notice Reverts if called by any account other than the admin.
modifier onlyAdmin() {
if (admin != msg.sender) {
revert Errors.CallerNotAdmin({ admin: admin, caller: msg.sender });
}
_;
}
​
/*//////////////////////////////////////////////////////////////////////////
USER-FACING NON-CONSTANT FUNCTIONS
//////////////////////////////////////////////////////////////////////////*/
​
/// @inheritdoc IAdminable
function transferAdmin(address newAdmin) public virtual override onlyAdmin {
// Effect: update the admin.
admin = newAdmin;
​
// Log the transfer of the admin.
emit IAdminable.TransferAdmin({ oldAdmin: msg.sender, newAdmin: newAdmin });
}
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

ghufranhassan1 Submitter
10 months ago
inallhonesty Lead Judge
10 months ago
inallhonesty Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.