Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

Initializers could be front-run

patonguch

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • Explain the specific issue or problem in one or more sentences

Initializers could be front-run, allowing an attacker to either set their own values, take ownership of the contract, and in the best case forcing a re-deployment
Instances (6):
​
```javascript
File: src/protocol/OracleUpgradeable.sol
​
function __Oracle_init(address poolFactoryAddress) internal onlyInitializing {
​
```
​
```javascript
File: src/protocol/ThunderLoan.sol
​
function initialize(address tswapAddress) external initializer {
​
function initialize(address tswapAddress) external initializer {
​
__Ownable_init();
​
__UUPSUpgradeable_init();
​
__Oracle_init(tswapAddress);
​
```

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Reason 2

    low

Impact:

  • Impact 1

  • Impact 2

    low

Proof of Concept

​

Recommended Mitigation

- remove this code
+ add this code
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!