Hawk High

Description:

The LevelOne and LevelTwo contracts is designed to be used with the UUPS (Universal Upgradeable Proxy Standard) pattern, but it lacks a constructor that calls _disableInitializers(). This is a critical security measure for upgradeable contracts that prevents the implementation contract from being initialized directly.

Attack path:

1. Attacker identifies that the implementation contract for LevelOne doesn't have a constructor with _disableInitializers()

2. Attacker directly calls the initialize(address _principal, uint256 _schoolFees, address _usdcAddress) function on the implementation contract (not the proxy)

3. Attacker sets themselves as the principal parameter

4. The implementation contract is now initialized with the attacker as the principal

Impact:

Attacker can gain principal privileges on the implementation contract

Recommended Mitigation:

Add a constructor to the LevelOne contract and LevelTwo contract that disables initializers: