Submission Details
Severity:
Unprotected upgradeable contract
Summary
LevelOneis an upgradeable contract. Anyone can call initialize on the logic contract .
Vulnerability Details
Malicious or accidental upgrades can break code logic, & exploits the functions then steal the fund of the protocol (Hawk High).
Impact
Tools Used
Recommendations
Add a constructor to ensure initialize cannot be called on the logic contract.
```diff
modifier notYetInSession() {
if (inSession == true) {
revert HH__AlreadyInSession();
}
_;
}
+constructor() {
+_disableInitializers();
+}
////////////////////////////////
///// /////
///// INITIALIZER /////
///// /////
////////////////////////////////
```
Updates
Lead Judging Commences
yeahchibyke 7 months ago
Submission Judgement Published Assigned finding tags:
contract can be re-initialized
The system can be re-initialized by an attacker and its integrity tampered with due to lack of `disableInitializer()`
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.