Part 2

Summary

The UsdToken contract calls a parent constructor ERC20(_name, _symbol), but no such constructor is present in the parent ERC20 contract. This creates a misleading assumption that the parent constructor is executed when, in fact, no code is being executed. This is a potential flaw that could lead to unexpected behavior.

Vulnerability Details

Description

In the UsdToken contract, the following constructor call is identified:

However, the parent ERC20 contract does not have a constructor that accepts _name and _symbol. This leads to:

• Misleading code that suggests initialization of the parent contract.

• Potentially overlooked initialization logic that should be explicitly handled in the UsdToken contract.

  However, the parent ERC20 contract does not have a constructor that accepts _name and _symbol. This leads to:

  • Misleading code that suggests initialization of the parent contract.

  • Potentially overlooked initialization logic that should be explicitly handled in the UsdToken contract.

Impact

• Misleading Code: Developers may incorrectly assume that _name and _symbol are being processed by the parent contract.

• Missed Initialization: Key logic expected in the parent constructor might not be executed, leading to incomplete or incorrect contract setup.

• Potential Security Risks: If the parent contract requires specific initialization steps, skipping these steps could lead to vulnerabilities.

Tools Used

1. Remix IDE: To identify constructor calls and validate parent contract structure.

2. Slither: For static analysis to detect flaws in constructor calls.

3. Manual Review: To analyze inheritance structure and constructor definitions.

Recommendations

Remove the Void Constructor Call:
If the parent contract ERC20 does not have a constructor accepting _name and _symbol, the call to ERC20(_name, _symbol) should be removed.

• Add Initialization Logic if Needed:
  If _name and _symbol are essential, consider implementing their handling directly within the UsdToken contract or by extending ERC20 with a properly defined constructor.

• Verify Parent Contract Requirements:
  Ensure that the parent contract does not rely on specific initialization steps that are being skipped.

• Review Contract Inheritance:
  Check all inherited contracts to confirm their constructors are correctly called or omitted as intended.

• Test Thoroughly:
  After making changes, test the UsdToken contract to ensure it behaves as expected and integrates seamlessly with the rest of the system.