Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Missing `_disableInitializers()` in constructor implementations of `LevelOne` and `LevelTwo`

s3bc40

Summary

The LevelOne and LevelTwo contracts are missing the _disableInitializers() call in their constructors. These contracts are using the Initializable pattern, and without _disableInitializers(), they are open to malicious attack if not properly initialized.

Impact

A malicious actor could re-initialize the implementation contract.

Tools Used

Manual review and solodit checklist.

Recommendations

Add _disableInitializers() to the constructor of both LevelOne and LevelTwo contracts to prevent any harm.

See https://docs.openzeppelin.com/contracts/5.x/api/proxy#Initializable

/// @custom:oz-upgrades-unsafe-allow constructor
constructor() {
_disableInitializers();
}
Updates

Lead Judging Commences

yeahchibyke Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

contract can be re-initialized

The system can be re-initialized by an attacker and its integrity tampered with due to lack of `disableInitializer()`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!