Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Unprotected initialize() in Upgradeable Contracts

aariiif

Summary

The StabilityPool's initialize() function lacks access control and initializer modifiers, allowing attackers to repeatedly call initialization to reset critical contract parameters and state.

Vulnerability Details

StabilityPool.initialize lacks access control, allowing re-initialization.

/StabilityPool.sol#initialize

function initialize(
address _rToken,
address _deToken,
address _raacToken,
address _raacMinter,
address _crvUSDToken,
address _lendingPool
) public initializer {
rToken = IRToken(_rToken);
deToken = IDEToken(_deToken);
raacToken = IRAACToken(_raacToken);
raacMinter = IRAACMinter(_raacMinter);
crvUSDToken = IERC20(_crvUSDToken);
lendingPool = ILendingPool(_lendingPool);
}

Path:

  1. Attacker calls initialize() after deployment

  2. Contract state is reset to new values

  3. Token addresses can be changed

  4. Protocol functionality hijacked

Impact

Attackers could reset contract state.

Tools Used

manual

Recommendations

Add initializer modifier and access control.

// Add OpenZeppelin's Initializable
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
​
contract StabilityPool is Initializable, OwnableUpgradeable {
function initialize(
address _rToken,
address _deToken,
address _raacToken,
address _raacMinter,
address _crvUSDToken,
address _lendingPool
) external initializer onlyOwner {
__Ownable_init(); // Initialize ownership
// Validate addresses
if (_rToken == address(0)) revert InvalidAddress();
if (_deToken == address(0)) revert InvalidAddress();
if (_raacToken == address(0)) revert InvalidAddress();
if (_raacMinter == address(0)) revert InvalidAddress();
if (_crvUSDToken == address(0)) revert InvalidAddress();
if (_lendingPool == address(0)) revert InvalidAddress();
// Set contract references
rToken = IRToken(_rToken);
deToken = IDEToken(_deToken);
raacToken = IRAACToken(_raacToken);
raacMinter = IRAACMinter(_raacMinter);
crvUSDToken = IERC20(_crvUSDToken);
lendingPool = ILendingPool(_lendingPool);
emit PoolInitialized(_rToken, _deToken, _raacToken);
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.