PanopticFactory::initialize is not protected #89
Labels
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-523
grade-b
QA (Quality Assurance)
Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
🤖_16_group
AI based duplicate group recommendation
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/PanopticFactory.sol#L134
Vulnerability details
Impact
PanopticFactory::initialize
is not protected, so it could be front-run and called by anyone during the deployment phase.Proof of Concept
The PanopticFactory::initialize is not protected. Thus during the deployment phase, it could be front-run and called by anyone to become the owner of the
Factory
.Since
owner
has the privilege to deploy new pools, the original-intended user could be DoSed from callingdeployNewPool
.Tools Used
Manual
Recommended Mitigation Steps
To mitigate, it is better to set the
s_owner
in the constructor to avoid unnecessary front-run.Assessed type
Access Control
The text was updated successfully, but these errors were encountered: