Hawk High
First Flight #39
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Hijack implementation contract ownership

vladich0x

Summary

Hijack implementation contract ownership

Vulnerability Details

Implementation of the upgradeable smart contract LevelOne.sol contains an initialization function LevelOne::initialize(), but does not provide the recommended constructor calling _disableInitializers(); in order to prevent a direct calls to initialize(). That's against the protocol recommendations and allows anyone to hijack ownership of the implementation contract, driving to undesired and vulnerable behavior.

Impact

  • attacker could call all functions restricted with onlyPrincipal

Tools Used

Manual review
Foundry

PoC

Add the following test to LevelOneAndGraduateTest.t.sol.

address attacker = makeAddr("attacker");
​
function testHijackImplementationContract() public {
vm.startPrank(attacker);
LevelOne(levelOneImplementationAddress).initialize(attacker, schoolFees, address(usdc));
vm.stopPrank();
​
address owner = LevelOne(levelOneImplementationAddress).getPrincipal();
​
assertEq(owner, attacker);
}

Recommendations

Add constructor to contract LevelOne with the following implementation:

+ constructor() {
+ _disableInitializers();
+ }

This way, the smart contract will prevent possible attacks by malicious users from directly calling the initialization of the smart contract and hijacking its ownership.

Updates

Lead Judging Commences

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

contract can be re-initialized

The system can be re-initialized by an attacker and its integrity tampered with due to lack of `disableInitializer()`

yeahchibyke Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

contract can be re-initialized

The system can be re-initialized by an attacker and its integrity tampered with due to lack of `disableInitializer()`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.