Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

StabilityPool constructor misuse leading to uninitialized owner

holsstian

Summary
https://github.com/Cyfrin/2025-02-raac/blob/main/contracts/core/pools/StabilityPool/StabilityPool.sol#L60-L60

In StabilityPool.sol we are using the constructor to initialize the owner. However the proxy contract that will initialize this StablilityPool implementation contract, does not use the constructor. Meaning the StablilityPool contract will have no owner.

Vulnerability Details

Here we are attempting to initialize an owner in the constructor for later to be used in the __Ownable_init function.

This will not work because the proxy does not initialize a contract using the constructor instead using the StabilityPool::initialize function. This means the owner will be address(0) leading the __Ownable_init function to revert due to an address(0) revert check.

// Constructor
constructor(address initialOwner) {
@> _initialOwner = initialOwner;
}
​
/**
* @notice Initializes the StabilityPool contract.
* @param _rToken Address of the RToken contract.
* @param _deToken Address of the DEToken contract.
* @param _raacToken Address of the RAAC token contract.
* @param _raacMinter Address of the RAACMinter contract.
*/
function initialize(
address _rToken,
address _deToken,
address _raacToken,
address _raacMinter,
address _crvUSDToken,
address _lendingPool
) public initializer {
if (_rToken == address(0) || _deToken == address(0) || _raacToken == address(0) || _raacMinter == address(0) || _crvUSDToken == address(0) || _lendingPool == address(0)) revert InvalidAddress();
@> __Ownable_init(_initialOwner);

Impact

No owner in StabilityPool contract leading to contract being uninitializable

Recommended mitigation

consider initializing the owner in the StabilityPool::initialize function instead

constructor(address initialOwner) {
- _initialOwner = initialOwner;
}
function initialize(
+ address _initialOwner
address _rToken,
address _deToken,
address _raacToken,
address _raacMinter,
address _crvUSDToken,
address _lendingPool
​
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!