search

sherlock-audit / 2022-10-mover-judging

1 stars 0 forks source link

GalloDaSballo - L-02 Frontrun of initializers #48

Closed sherlock-admin closed 2 years ago

sherlock-admin commented 2 years ago

GalloDaSballo

low

L-02 Frontrun of initializers

Summary

Initializer can be front-run setting the caller to the owner.

Vulnerability Detail

https://github.com/sherlock-audit/2022-10-mover/blob/main/cardtopup_contract/contracts/ContractWhitelist.sol#L25-L26

    function initialize() public initializer {

Impact

Code Snippet

Tool used

Manual Review

Recommendation

It may be worth creating a constructor to set the only caller for initialize, or simply make sure you're the first one calling it