Thunder Loan
AI First Flight #7
Beginner FriendlyFoundryDeFiOracle
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

# [M-2] Failure-to-initialize of proxy. Someone else can front-fun call `initialize`, and then claim the owner

hmpippo

[M-2] Failure-to-initialize of proxy. Someone else can front-fun call initialize, and then claim the owner

Description

In a proxy contract, we use initialize instead of constructor to initialize the proxy states. However, if someone else front-run us to call the initialize function, he will become the owner of protocol. And the devs have to re-deploy the protocol!

Risk

Likelihood: Medium

  • Someone may front run you to initialize.

Impact:: High

  • The protocol owner is taken by others!

Proof of Concept

Recommended Mitigation

We should initialize within deploy in one transaction.

ThunderLoan thunderLoan = new ThunderLoan();
- new ERC1967Proxy(address(thunderLoan), "");
+ new ERC1967Proxy(address(thunderLoan), abi.encodeWithSignature("initialize()"));
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 8 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!