Submission Details
Severity:
Upgradeable contracts are not initialized
Summary
Upgradeable contracts like AccessControlUpgradeable and ERC1155Upgradeable are not initialized.
Vulnerability Details
__AccessControl_init() and __ERC1155_init(uri_) is not called when importing upgradeable contracts
Usually this should be a medium issue but since the initialization is for best practice, setting it as low.
It is also noted that ERC1155Upgradeable initialize function will call setURI(), which is called directly.
function initialize(
string memory name_,
string memory symbol_,
string memory uri_,
address creator_,
address currency_
) external initializer {
_name = name_;
_symbol = symbol_;
creator = creator_;
currency = currency_;
_setURI(uri_);
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(DAO_CREATOR, creator_);
_grantRole(OWP_FACTORY_ROLE, msg.sender);
}
Impact
Best practice, low impact
Tools Used
Recommendations
Call __AccessControl_init() and __ERC1155_init(uri_) in MembershipERC1155 initialize()
function initialize(
string memory name_,
string memory symbol_,
string memory uri_,
address creator_,
address currency_
) external initializer {
+ __AccessControl_init();
+ __ERC1155_init(uri_);
_name = name_;
_symbol = symbol_;
creator = creator_;
currency = currency_;
_setURI(uri_);
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
_grantRole(DAO_CREATOR, creator_);
_grantRole(OWP_FACTORY_ROLE, msg.sender);
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128
USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.