Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing call to _disableInitializers() in StabilityPool's constructor

h2134

Summary

Missing call to _disableInitializers() in StabilityPool's constructor.

Vulnerability Details

StabilityPool is an upgradable contract and is expected to be deployed as a proxy, however, _disableInitializers() is not called in the implementation contract's constructor.

StabilityPool::constructor()

constructor(address initialOwner) {
_initialOwner = initialOwner;
}

Impact

An uninitialized contract can be taken over by an attacker. This applies to both a proxy and its implementation contract, which may impact the proxy. To prevent the implementation contract from being used, you should invoke the _disableInitializers() function in the constructor to automatically lock it when it is deployed.

Tools Used

Manual Review

Recommendations

Consider calling _disableInitializers() in the constructor.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!