Hawk High

Summary

(HIGH) Unprotected Upgrade Function - Unauthorized contract upgrade leading to potential arbitrary code execution

Vulnerability Details

Affected Asset

https://github.com/CodeHawks-Contests/2025-05-hawk-high/blob/main/src/LevelOne.sol#L314

Impact

The _authorizeUpgrade function, which is supposed to restrict who can upgrade the contract, is empty. This means anyone can upgrade the contract to a malicious implementation, effectively taking control of the contract and any funds it holds. The graduateAndUpgrade function calls _upgradeToAndCall which uses the _authorizeUpgrade function. Because _authorizeUpgrade is empty, it does not prevent anyone from upgrading the contract.

Likelihood of Exploitation: High. The absence of access control on the upgrade function makes the contract extremely vulnerable. An attacker could easily deploy a malicious contract and upgrade the LevelOne contract, leading to complete control.

Tools Used

1. Manual Review

2. AI Assistance report writting

Recommendations

1. Implement Access Control: In the _authorizeUpgrade function, check if the caller is the authorized upgrade administrator.