code-423n4 / 2021-05-nftx-findings

1 stars 0 forks source link

Contract `NFTXDeferEligibility` should not include a `constructor` #101

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

The contract NFTXDeferEligibility includes a constructor; however, according to the documentation from Openzeppelin, it shouldn't:

Due to a requirement of the proxy-based upgradeability system, no constructors can be used in upgradeable contracts.

If we deploy the NFTXDeferEligibility through the upgrades.deployProxy function (as written in the tests), we will get an error:

contracts/solidity/eligibility/NFTXDeferEligibility.sol:23: Contract `NFTXDeferEligibility` has a constructor
    Define an initializer instead

Proof of Concept

Referenced code: NFTXDeferEligibility.sol#L23-L25

Tools Used

None

Recommended Mitigation Steps

Remove the constructor in the contract.