Submission Details
Severity:
Missing `_disableInitializers()` in Upgradeable Contract Constructor of StabilityPool
Summary
The StabilityPool contract is upgradeable but fails to call _disableInitializers() in its constructor, which could potentially allow the initialization function to be called multiple times in the implementation contract.
Vulnerability Details
constructor(address initialOwner) { <==@found
_initialOwner = initialOwner;
}
Impact
Implementation contract could be initialized multiple times
State variables set in constructor won't be properly stored
Tools Used
Manual Review
Recommendations
Add _disableInitializers() to the constructor:
+ constructor() {
- constructor(address initialOwner) {
- _initialOwner = initialOwner;
+ _disableInitializers();
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.