Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Should put `_disableInitializers` in Implementation contract

vincent71399

Description: If _disableInitializers is not used in the LevelOne and LevelTwo contracts,
anyone can invoke the initialize function on the implementation contracts.
While this may not immediately impact the proxy contract,
it's still a best practice to include _disableInitializers to avoid potential vulnerabilities or misuse.

Impact: If the implementation contract contains dangerous functions like selfdestruct callable by a privileged account,
an attacker could exploit this to destroy the implementation contract, rendering the proxy contract unusable.

Recommended Mitigation: add _disableInitializers in the constructor of LevelOne and LevelTwo contract

constructor() {
_disableInitializers();
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

contract can be re-initialized

The system can be re-initialized by an attacker and its integrity tampered with due to lack of `disableInitializer()`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.