Hawk High

Summary

The LevelTwo::graduate function is marked with the reinitializer(2) modifier and is publicly accessible without any access control. This means any external user can invoke it once, consuming the contract's version 2 reinitialization slot. As a result, the legitimate contract owner (e.g., the principal) may be permanently prevented from executing critical upgrade-time logic, such as setting new variables or distributing funds.

Vulnerability Details

Issue Explanation

1. Unrestricted Access
   Since the function is public and has no onlyPrincipal or equivalent modifier, any address can call it.

2. Consumes reinitializer(2)
   The reinitializer(2) modifier ensures that this function can only be executed once. If a malicious user calls it first, the contract is marked as "initialized to version 2", blocking any future reinitializer(2) logic.

3. Breaks Upgrade Safety
   This may prevent proper initialization of new state variables or distribution of resources introduced in LevelTwo, leading to broken business logic and stuck funds.

Impact

• Denial of Initialization: Legitimate parties are blocked from performing upgrade-time setup.

• Potential Logic Incompleteness: Contract may remain in a partially-upgraded, unusable state.

• System Integrity Loss: Future UUPS upgrades or state transitions may silently fail.

Tools Used

• Manual Code Review

Recommendations

Add appropriate access control (e.g., onlyPrincipal) to restrict graduate() execution to authorized parties only:

Alternatively, consider making graduate() internal if it is only intended to be called within another controlled flow.