Submission Details
Impact:
Likelihood:
[H-8] Unprotected Logic Contract Initialization
Description
The logic (implementation) contract does not disable its initializer in the constructor. This allows anyone to initialize it separately from the proxy, potentially taking control.
Impact
Unauthorized initialization can result in a malicious user setting themselves as principal
Tools Used
Manual review
Recommendations
Add this to the constructor of LevelOne.sol :
constructor() {
_disableInitializers();
}
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.