Description:
The LevelOne.sol contract is deployed as an implemntation contract and is not meant to be used directly. Instead a proxy delegates calls to it. However, the implementation contract is still on-chain so anyone can call #initialize because it's public and unprotected.

Impact:
The initializer of the contract can become the principal and gain access to onlyPrincipal functions such as #_authorizeUpgrade. This could allow an attacker to replace the implementation contract with malicious logic to drain funds.

Proof of Concept:

1. The logic contract is deployed and never initialized.

2. Attacker calls initialize() → becomes principal.

3. Attacker calls upgradeToAndCall(maliciousImpl, data) via the proxy → allowed because they are now principal.

4. maliciousImpl has a selfdestruct or token drain.

5. Proxy is now broken, or funds are stolen.

Tools

• Slither

• Foundry

Recommended Mitigation:
OpenZeppelin recommends a constructor-based protection pattern to block calls to initialize() on the logic contract directly: