Dria

Summary

In Solidity, code that is inside a constructor or part of a global variable declaration is not part of a deployed contract’s runtime bytecode. This code is executed only once, when the contract instance is deployed.

Swan.sol, LLMOracleCoordinator.sol and LLMOracleRegistry.sol are upgradeable contracts that use non-upgradeable contract libraries. This cause the code within a logic contract’s constructor (non-upgradeable contract libraries) will never be executed in the context of the proxy’s state. To rephrase, proxies are completely oblivious to the storage trie changes that are performed by the constructor.

For more detail can be check here

Vulnerability Details

1. Swan.sol use ERC20 and ERC721 libraries instead of ERC20Upgradeable and ERC721Upgradeable

2. LLMOracleCoordinator.sol use ERC20 library instead of ERC20Upgradeable

3. LLMOracleRegistry.sol use ERC20 library instead of ERC20Upgradeable

Consider for example ERC20 from OpenZeppelin Contracts: the contract initializes the token’s name and symbol in its constructor

Instead, make sure to use @openzeppelin/contracts-upgradeable, which is an official fork of OpenZeppelin Contracts that has been modified to use initializers instead of constructors. Take a look at what ERC20Upgradeable looks like in @openzeppelin/contracts-upgradeable:

Impact

The code within a logic contract’s constructor (non-upgradeable contract libraries) will never be executed in the context of the proxy’s state

Tools Used

Manual Review

Recommended Mitigation

Consider use upgradeable contracts libraries