Skip to content

Latest commit

 

History

History
51 lines (32 loc) · 2.14 KB

051.md

File metadata and controls

51 lines (32 loc) · 2.14 KB

Mysterious Plum Griffin

High

Missing _disableInitializers in constructor enables reinitialization of implementation contract

Summary

The missing _disableInitializers in the constructor of UUPS contracts will cause potential reinitialization risk as anyone can invoke an initializer on the implementation contract directly. https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosProfile.sol#L45 https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosReview.sol#L29 https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosVote.sol#L26 https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosDiscussion.sol#L29 https://github.com/sherlock-audit/2024-10-ethos-network/blob/main/ethos/packages/contracts/contracts/EthosAttestation.sol#L59

Root Cause

In UUPS contracts, the _disableInitializers call is missing from the constructor. Without this call, the implementation contract remains uninitialized and can be invoked by anyone to run an initializer function on it.

Internal pre-conditions

  1. The contract must lack _disableInitializers in the constructor.
  2. The implementation contract must be deployed in a way that allows direct interaction.
  3. The contract must include at least one initializer function callable externally.

External pre-conditions

No response

Attack Path

  1. An external user must attempt to initialize the UUPS implementation contract.
  2. Contract deployment is public, allowing unauthorized access if initialized.

Impact

The protocol suffers potential state corruption or unauthorized configuration changes, which may lead to malfunction or loss of control over contract behavior. The attacker gains control over the initialization process and can modify contract parameters maliciously.

PoC

No response

Mitigation

Add _disableInitializers() to the constructor of each UUPS implementation contract to prevent the risk of reinitialization.

  constructor() {
    _disableInitializers();
  }