Root Cause + Impact

initialize() sets 5 critical protocol addresses without zero-address validation. The initializer modifier ensures this function runs exactly once per proxy, so a misconfigured deployment produces a permanently non-functional proxy that must be redeployed.

Description

All 5 address parameters are written to storage without checks:

Unlike constructors in non-upgradeable contracts, initialize() cannot be called again if a mistake is made. OpenZeppelin's initializer modifier flips a storage flag on the first call, permanently blocking subsequent calls. This makes input validation especially important: there is no second chance.

Each of the 5 addresses is used in core protocol functions:

• aavePool -- called in createLeveragedPosition(), unwindPosition(), and executeOperation() for flash loans, supply, borrow, repay, and withdraw

• aaveDataProvider -- called in calculateOpenParams() and _executeUnwindOperation() for reserve configuration

• oneInchRouter -- called in _call1InchSwap() for every swap

• strataxOracle -- called in calculateOpenParams(), calculateUnwindParams(), and _executeUnwindOperation() for pricing

If any of these is address(0), the corresponding low-level call reverts with no meaningful error message. The proxy appears deployed but every user-facing operation fails.

Note that setStrataxOracle() does validate for zero address (L264), but the initial assignment in initialize() does not. This is inconsistent.

Risk

Likelihood: Low -- Requires a deployment error. Automated scripts and test suites reduce this risk, but the contract provides no safety net of its own.

Impact: Medium -- A misconfigured proxy is permanently non-functional. The protocol must deploy a new proxy, update all references, and redirect users. Any tokens sent to the broken proxy address before discovery require manual recovery via a new proxy pointing to the same beacon.

Proof of Concept

The initializer modifier from OpenZeppelin sets _initialized = 1 on first call and reverts on all subsequent calls. Deploying a BeaconProxy with _aavePool = address(0):

Recommended Mitigation

Validate all addresses before committing them to storage. Since the initializer modifier prevents re-calling, these checks are the only safety net against a misconfigured deployment: