Submission Details
Impact:
Likelihood:
Unprotected Reinitializer on `LevelTwo::graduate()`
Description: LevelTwo::graduate() is marked public reinitializer(2) with no access control, so anyone can invoke it once the proxy is at version < 2
Impact: An attacker can prematurely trigger graduation logic or malicious hooks in a future implementation, potentially manipulating state or skipping required flows.
Recommended Mitigation: Restrict to principal:
- function graduate() public reinitializer(2) {
+ function graduate() public onlyPrincipal reinitializer(2) {
}
Rewards breakdown
nSLOC
243This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.