Submission Details
Severity:
[H-8] Unprotected Logic Contract Initialization
Description
The logic (implementation) contract does not disable its initializer in the constructor. This allows anyone to initialize it separately from the proxy, potentially taking control.
Impact
Unauthorized initialization can result in a malicious user setting themselves as principal
Tools Used
Manual review
Recommendations
Add this to the constructor of LevelOne.sol :
constructor() {
_disableInitializers();
}
Updates
Lead Judging Commences
yeahchibyke 7 months ago
Submission Judgement Published Assigned finding tags:
contract can be re-initialized
The system can be re-initialized by an attacker and its integrity tampered with due to lack of `disableInitializer()`
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.