Hawk High

Summary

The LevelOne contract is an upgradeable contract that doesn't properly protect its initialization function, allowing anyone to potentially delete the contract.

Vulnerability Details

The contract inherits from UUPSUpgradeable but doesn't implement proper access controls on the initialization function:

While the _authorizeUpgrade function has the onlyPrincipal modifier, the upgrade mechanism itself may be vulnerable due to improper initialization protection.

Impact

The vulnerability allows an attacker to call upgradeToAndCall from the UUPSUpgradeable contract and replace the implementation with a malicious one. Also the attacker can take control of the contract's funds and functionality. Lastly the attacker can effectively delete the contract by upgrading to an implementation with no functionality

Recommendations

Add proper access control to the initialize function