Open code423n4 opened 2 years ago
The UDT contract has already been deployed and initialized so I am not sure any of these are real issues anymore.
As the sponsor has outlined, contracts have already been deployed and this does not pose any risk. However, I'll keep it open for future reference.
Handle
hagrid
Vulnerability details
When we deploy the
UnlockDiscountTokenV2
contract to the any test network, it is possible to frontruninitialize
function. Also, Remix IDE shows two differentinitialize
method for this contract.The first one is overridden:
initialize(address _minter)
. And, the other one is default one for initialize function which is:initialize(string name, string symbol, uint8 decimals)
.So, it is possible to execute second one before the first one
initialize(address _minter)
. In this case, following lines will be eliminated:Therefore, contract will be initialized with wrong arguments. Current minter address will be
address(0)
. As a result, it will be impossible to change minter address.Proof of Concept
UnlockDiscountTokenV2
contract to the Remix IDE.initialize2()
method.initialize(string name, string symbol, uint8 decimals)
method instead ofinitialize(address _minter)
.addMinter(address account)
method.Minter
role.Tools Used
Remix IDE
Recommended Mitigation
Properly implement the overridden
initialize
function.