Core Contracts

Summary

Looking at the code in StabilityPool we can see that it is meant to be upgradeable, however, it uses the basic ReentrancyGuard contract instead of the upgradeable one. What is more, it does not invoke the disableInitializers function in the constructor.

Impact

Potential storage collision and also introduces a severe risk, allowing potential attackers to initialize the implementation contract itself.

Tools Used

Manual review

Recommendations

Use ReentrancyGuardUpgradeable and invoke disableInitializers in the constructor of the StabilityPool.