Missing call to _disableInitializers in KeeperProxy.sol
Summary
The KeeperProxy contract is an upgradeable contract but doesn't have a constructor that disables initializers. Upgradeable contracts should always disable initializers in their constructor to prevent contract being taken over by an attacker
Vulnerability Details
Missing call to _disableInitializers
In the current code, there's no constructor at all
Without a constructor that disables initializers, someone could potentially initialize the implementation contract itself.
Impact
Frontrunning initialize function
Tools Used
Manual Review
Recommendations
add constructor and call _disableInitializers
Lead Judging Commences
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.