Core Contracts

Summary

Missing disableinitializers() in constructor can lead to malicious takeover of the implementation contract

Vulnerability Details

The StabilityPool inherits from OpenZeppelins Initializable but it does not implement the disableinitializers() function in the constructor. Which means both proxy and implementation contract can be taken over by an attacker. This is because when the StabilityPool contract is deployed and initialized, the initialize method on the newly created StabilityPool proxy's implementation contract is never called. That means anyone can call the initialize method with any arbitrary arguments which could effect the proxy contract state.

Impact : Medium

Tools Used

Manual Review

Recommendations

In order to prevent leaving an implementation contract uninitialized it is recommended adding the _disableInitializers() function in the constructor to lock the StabilityPool contracts automatically when they
are deployed.