Part 2

Summary

Zaros's Dex Adaptor Contracts contract suffers from a DoS issue due to improper usage of the initializer modifier in its inheritance chain. The conflict arises when the contract's initialize function attempts to invoke the __BaseAdapter_init function of its parent contract, BaseAdaptor. Since both contracts utilize the initializer modifier, the process fails, leaving all the Dex Adaptor contracts in an unusable state after deployment. This effectively causes a denial of service, preventing any use of the contracts.

Vulnerability Details

Let's understand this issue by taking the example of CurveAdapter contract though the issue is present in all of the Dex Adaptor Contracts.

The vulnerability is caused by the interaction between the initializer modifier in both the CurveAdapter and BaseAdaptor contracts. When the initialize function of CurveAdapter is called, it first executes its own initialization logic, where the initializer modifier is invoked for the first time:
CurveAdapter.sol#L59

Subsequently, it attempts to call the __BaseAdapter_init method of the parent contract, BaseAdaptor, to initialize the owner:
BaseAdapter.sol#L64

At this point, the initializer modifier in BaseAdaptor is triggered again. Since this modifier is designed to prevent a function from being called more than once, it detects that the contract has already been initialized (due to the initial call in CurveAdapter) when it reaches the BaseAdaptor __BaseAdapter_init function:

This leads to a failure at the check defined in the initializer modifier in BaseAdaptor, which causes the entire initialization process to fail, leaving the contract in a non-functional state after deployment.

Impact

None of the Dex Adaptor contracts can be properly initialized, leading to a complete denial of service.

Tools Used

Manual Review

Recommendations

1. Replace initializer Modifier with onlyInitializing in BaseAdaptor.

2. Make __BaseAdapter_init function internal: Restrict access to the BaseAdaptor's initialize function so that it can only be called internally by derived contracts like CurveAdaptor.