Submission Details
Impact:
Likelihood:
Unprotected Upgrade
The LevelOne.sol contract uses the Universal Upgradeable Proxy Standard (UUPS) to allow future upgrades to the smart contract. However, it was not possible to confirm that the _authorizeUpgrade(address) function is implemented with the appropriate restrictions.
Risk: Without the _authorizeUpgrade() function implemented and restricted to an administrative role (e.g. onlyPrincipal), any user can override the contract logic with malicious logic, taking full control of the funds and functionality
// SPDX-License-Identifier: MIT
import "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
contract LevelOne is Initializable, UUPSUpgradeable {
address public principal;
function initialize(/* parameters */) public /* without initializer */ {
// ...
principal = msg.sender;
// ...
}
/// @notice Upgrade authorization function without any restriction
function _authorizeUpgrade(address newImplementation) internal override {
// no control: vulnerable!
}
// rest of the contract...
}
// SPDX-License-Identifier: MIT
import "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
contract LevelOne is Initializable, UUPSUpgradeable {
address public principal;
/// @notice Can only be executed once
function initialize(/* parameters */) public initializer {
// Initialize state
principal = msg.sender;
// other settings...
}
/// @notice Modifier that allows only the principal (administrator)
modifier onlyPrincipal() {
require(msg.sender == principal, "LevelOne: caller is not principal");
_;
}
/// @notice Protects the upgrade so only the principal can perform it
function _authorizeUpgrade(address newImplementation)
internal
override
onlyPrincipal
{}
// rest of the contract...
}
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.