Core Contracts

Summary

disableinitializers is not called in StabilityPool's constructor

Vulnerability Details

An uninitialized contract can be taken over by an attacker. This applies to both a proxy and its implementation contract, which may impact the proxy. But in the case of the implementation contract, a disableinitializers() is necessary to be called in the constructor. This is because when the StabilityPool contract is deployed and initialized, the initialize method on the newly created proxy's implementation contract is never called. As such, anyone can call that method and pass in whatever values they want as arguments.

Impact

An attacker can call StabilityPool::initialize and pass arbitrary arguments

Tools Used

Manual Review

Recommendations

Add the following constructor: