Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

[M-1] Missing `disableInitializers` in `StabilityPool.sol` Upgradeable Contract Constructor.

aye__aye

Summary

The StabilityPool.sol contract is meant to be upgradable, but it initializes an immutable variable _initialOwner through the constructor.As proxies never calls the constructor, this variable remains uninitialized and is passed through the contracts initialize()function where it initializes the owner __Ownable_init(_initialOwner).

Vulnerability Details

https://github.com/Cyfrin/2025-02-raac/blob/89ccb062e2b175374d40d824263a4c0b601bcb7f/contracts/core/pools/StabilityPool/StabilityPool.sol#L59

constructor(address initialOwner) {
_initialOwner = initialOwner;
}

Impact

Tools Used

manual review

Recommendations

  1. use _disableInitializers() inside the constructor.

constructor() {
_disableInitializers()
}

  1. move the initialization of the owner to the initialize() function and change the private immutable _initialOwner to a private initialOwner variable.

- address private immutable _initialOwner;
+ address private initialOwner;
​
function initialize(
address _rToken,
address _deToken,
address _raacToken,
address _raacMinter,
address _crvUSDToken,
address _lendingPool,
+ address _initialOwner
) public initializer {
+ initialOwner= _initialOwner;
+ __Ownable_init(_initialOwner);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.