Root + Impact

Description

• metadataFrozen is declared as a public state variable but is never explicitly initialized. While Solidity zero-initializes boolean variables to false by default, leaving safety-critical flags without explicit initialization is an unsafe pattern that can confuse readers and auditors.

Risk

Likelihood:

• The variable is always false by default and behaves correctly in practice.

• Risk arises if a future refactor mistakenly relies on it being true without explicit initialization.

Impact:

• No immediate exploit, but reduces code clarity and introduces latent risk.

Proof of Concept

Recommended Mitigation

Explicitly initialize the variable in the constructor or at declaration.