Submission Details
Severity:
The `contstructor()` in the `StabilityPool` contract will not be initialized
Summary
In the `StabilityPool` contract, a constructor was defined that sets the `_initialOwner` to `initialOwner`.
```javascript
constructor(address initialOwner) {
_initialOwner = initialOwner;
}
```
But the `StabilityPool` is an upgradedable smart contract.In an upgradeable contract using proxies, the proxy contract does not call the constructor of the logic contract. Instead, the initialize() function must be used for initialization, but in the stability pool a constructor was used that sets the `_initialOnwer` to the `initialOwner` as shown in the code snippet above above. Futhermore, the `_initialOwner` is then set as a parameter in the `_Ownable_init()` method inside the `initialize()` function.
```javascript
function initialize(
address _rToken,
address _deToken,
address _raacToken,
address _raacMinter,
address _crvUSDToken,
address _lendingPool
) public initializer {
if (_rToken == address(0) || _deToken == address(0) || _raacToken == address(0) || _raacMinter == address(0) || _crvUSDToken == address(0) || _lendingPool == address(0)) revert InvalidAddress();
@>> __Ownable_init(_initialOwner);
__Pausable_init();
rToken = IRToken(_rToken);
deToken = IDEToken(_deToken);
raacToken = IRAACToken(_raacToken);
raacMinter = IRAACMinter(_raacMinter);
crvUSDToken = IERC20(_crvUSDToken);
lendingPool = ILendingPool(_lendingPool);
// Get and store the decimals
rTokenDecimals = IRToken(_rToken).decimals();
deTokenDecimals = IDEToken(_deToken).decimals();
}
```
Impact
The impact is low, but this implementation may still result to an unprecidented behaviour
Tools Used
manual analysis
Recommendations
consider removing the constructor from the contract and add the `initialOwner` parameter inside the `initialize()` function
```diff
-constructor(address initialOwner) {
- _initialOwner = initialOwner;
-}
function initialize(
address _rToken,
address _deToken,
address _raacToken,
address _raacMinter,
address _crvUSDToken,
address _lendingPool,
+ address _initialOwner
) public initializer {
if (_rToken == address(0) || _deToken == address(0) || _raacToken == address(0) || _raacMinter == address(0) || _crvUSDToken == address(0) || _lendingPool == address(0)) revert InvalidAddress();
__Ownable_init(_initialOwner);
__Pausable_init();
rToken = IRToken(_rToken);
deToken = IDEToken(_deToken);
raacToken = IRAACToken(_raacToken);
raacMinter = IRAACMinter(_raacMinter);
crvUSDToken = IERC20(_crvUSDToken);
lendingPool = ILendingPool(_lendingPool);
// Get and store the decimals
rTokenDecimals = IRToken(_rToken).decimals();
deTokenDecimals = IDEToken(_deToken).decimals();
}
```
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.