Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Uninitialized Proxy Implementation

luffy

Summary

Implementation contracts lack initialization protection, allowing attackers to hijack the contract if not properly initialized.

Vulnerability Details

// In PerpsEngineImplementation.sol
function initialize(address admin) public {
require(_admin == address(0), "Already initialized");
_admin = admin;
}

Impact

  • Malicious actors could initialize contracts with their own address

  • Complete protocol takeover

Tools Used

  • Manual review

  • MythX

Recommendations

// Add initializer modifier from OpenZeppelin
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
​
contract PerpsEngineImplementation is Initializable {
function initialize(address admin) public initializer {
_admin = admin;
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.