Submission Details
Severity:
`SwanManager` is inheriting `OwnableUpgradeable` but not calling `__Ownable_init()` to set owner so owner will be default 0 and will never be changed.
Vulnerability Details:
Since SwanManager is not abstract contract and it is upgradeable. So it can be deployed on it's own. It is inheriting OwnableUpgradeable and using it's onlyOwner modifier. And this is upgradeable contract so __Ownable_init() should be called in initialize function to set owner.
Otherwise onlyOwner using function will never work. And owner can not be changed as initial owner is 0.
30 : contract SwanManager is OwnableUpgradeable {
//@audit initialize is not defined and __Ownable_init() not called
https://github.com/Cyfrin/2024-10-swan-dria/blob/main/contracts/swan/SwanManager.sol
Impact :
onlyOwner using functions will never work.
Recommendation
Add this function in SwanManager.sol.
+ /// @notice Initialize the contract.
+ function initialize() public initializer {
+ __Ownable_init(msg.sender);}
Prize pool breakdown
Total prize
21,000 USDC
nSLOC
1,03420 USDC / LOC
20,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.