Submission Details
Severity:
Uninitialized OpenZeppelin Upgradeable Contracts
[MEDIUM-3] Uninitialized OpenZeppelin Upgradeable Contracts
Location
KeeperProxy.sol contract initialization
Description
The contract inherits from OpenZeppelin's upgradeable contracts but fails to properly initialize them in the initialization function.
Impact
Potential bypass of access controls
Undefined contract states
Risk of contract takeover
Proof of Concept
contract InitializationTest is Test {
KeeperProxy public proxy;
function testMissingInitialization() public {
proxy = new KeeperProxy();
// Initialize without calling parent initializers
proxy.initialize();
// Verify owner is not set correctly
address owner = proxy.owner();
assertEq(owner, address(0), "Owner should not be set");
}
}
Recommendation
Properly initialize all inherited contracts:
contract KeeperProxy is Initializable, Ownable2StepUpgradeable, ReentrancyGuardUpgradeable {
function initialize() public initializer {
__Ownable2Step_init();
__ReentrancyGuard_init();
// Additional initialization logic
}
}
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026
USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.