Summary

https://github.com/Cyfrin/2025-01-zaros-part-2/blob/39e33b2f6b3890573bb1affc41a7e520277ceb2c/src/zlp/ZlpVault.sol#L59

The ZlpVault contract contains an unchecked initializer function, making it susceptible to misuse. If an attacker interacts with the implementation contract directly, they could call the initialize function to gain ownership and control over the contract. This vulnerability arises from improper restriction of initialization.

Vulnerability Details

The vulnerable code resides in the initialize function:

The initializer modifier prevents re-initialization but does not prevent the function from being called directly on the implementation contract.

An attacker could deploy the implementation contract, invoke initialize, and gain ownership (__Ownable_init(owner)).

Impact

Ownership Takeover: The attacker can set themselves as the owner, allowing them to:

Upgrade the contract.

Call privileged functions guarded by onlyOwner.

Fund Loss: Improper initialization could lead to mismanagement of assets or complete loss.

Contract Disruption: Proxy deployment relying on the implementation may fail if the implementation is initialized incorrectly.

Tools Used

Manual Review

Recommendations

Restrict Initialization to Proxy Contracts

Add a validation check to ensure the initialize function is only executed via a proxy:

Replace implementationAddress with the actual implementation contract address.

Use constructor to Disable Initialization Permanently

This feature is already present in the contract, but confirm it is enforced: