Missing initialization for upgradeable contracts: __UUPSUpgradeable_init
Links:
https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleCoordinator.sol#L130
https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/llm/LLMOracleRegistry.sol#L81
https://github.com/Cyfrin/2024-10-swan-dria/blob/c8686b199daadcef3161980022e12b66a5304f8e/contracts/swan/Swan.sol#L126
Missing initializers in upgradeable contracts can create security and functional risks, such as:
-
Uninitialized State Variables
-
Takeover Vulnerability: An attacker can deploy a proxy pointing to the uninitialized implementation contract and then call an initializer to take ownership.
-
Incorrect Contract State
Recommendations
Add the following line of code to the initialize function in the LLMOracleCoordinator, LLMOracleRegistry and the Swan contract:
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.