Core Contracts

Summary

The StabilityPool uses UUPS upgradeability, risking storage collisions or malicious upgrades if the proxy admin is compromised.

Vulnerability Details

The StabilityPool contract uses UUPS upgradeability, which, if not managed properly, could lead to storage collisions or malicious upgrades. The initialize() function lacks access control, increasing the risk.

Impact

If the proxy admin is compromised, an attacker could execute malicious upgrades, potentially stealing funds or disrupting the protocol's operations.

The project's use of upgradeable contracts, such as those potentially used in the StabilityPool, aligns with this concern. Ensuring secure upgrade patterns is crucial.

Tools Used

• Manual review

Recommendations

Ensure robust access control and consider using more secure upgrade patterns.