panopticFactory.initialize() can be frontrunned #251
Labels
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-523
edited-by-warden
grade-c
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
🤖_16_group
AI based duplicate group recommendation
unsatisfactory
does not satisfy C4 submission criteria; not eligible for awards
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/PanopticFactory.sol#L134
Vulnerability details
Impact
Unsafe initialize function,
PanopticFactory.initialize()
can be front-runned, When the factory contract is deployed andinitialize()
function is called by whoever the owner is,Anyone monitoring the mempool can frontrun thePanopticFactory.initialize()
and take ownership of the contract since it can be called by anyone. Refer to the below simple coded-poc. Paste the below test under test/foundry and runforge test --match-path test/foundry/testfile.t.sol
Proof of Concept
Tools Used
Vs-Code/Foundry
Recommended Mitigation Steps
Maybe include the initialize in the constructor.(Just a suggestion)
Assessed type
Other
The text was updated successfully, but these errors were encountered: