Core Contracts

Summary

The StabilityPool contract is designed as an upgradeable contract using OpenZeppelin's Initializable pattern. However, the contract contains a constructor that sets critical state variables (e.g., _initialOwnerand a state varible uint256 public index = 1e18 . When deployed via a proxy, the constructor is not executed and this state varible is not set, leaving these values uninitialized. This oversight can result in the contract operating with default or zero values for these important variables, potentially compromising the contract's security and intended functionality.

Vulnerability Details

The StabilityPool contract includes a constructor intended to initialize vital state variables:

In an upgradeable contract deployed via a proxy, constructors are bypassed, and initialization must occur in an initialize function. Since the constructor is not called during proxy deployment:

• The _initialOwner variable remains uninitialized (defaulting to the zero address).

• The index variable is also not explicitly set by the initializer.

POC

1. Deployment via Proxy:

   • The StabilityPool contract is deployed behind a proxy.

   • The proxy’s delegatecall bypasses the constructor, so _initialOwner is not set to the intended owner address.

2. Ownership Exploitation:

   • Since _initialOwner is not set, the OwnableUpgradeable logic might fall back on the zero address or an uninitialized state.

   • An attacker could potentially assume control by exploiting the absence of a proper owner, thereby invoking restricted functions (e.g., adding/removing managers, updating allocations, or setting the liquidity pool).

Impact

An uninitialized owner variable can leave the contract vulnerable to unauthorized access, potentially allowing an attacker to seize control of critical admin functions.

Tools Used

Manual Review

Recommendation

Replace the constructor with an initializer function to properly set the _initialOwner and any other critical state variables (such as index) when the contract is deployed via a proxy. For example: