peanuts - Initializer can be frontrunned

[github-actions[bot]]

peanuts

low

Initializer can be frontrunned

Summary

There is nothing preventing another account from calling the initializer before the contract owner.

Vulnerability Detail

    function initialize(
        address _owner,
        uint256 _overhead,
        uint256 _scalar,
        bytes32 _batcherHash,
        uint64 _gasLimit,
        address _unsafeBlockSigner
    ) public initializer {
        require(_gasLimit >= MINIMUM_GAS_LIMIT, "SystemConfig: gas limit too low");
        __Ownable_init();
        transferOwnership(_owner);
        overhead = _overhead;
        scalar = _scalar;
        batcherHash = _batcherHash;
        gasLimit = _gasLimit;
        _setUnsafeBlockSigner(_unsafeBlockSigner);
    }

Impact

In the best case, the owner is forced to waste gas and re-deploy. In the worst case, the owner does not notice that his/her call reverts, and everyone starts using a contract under the control of an attacker

Code Snippet

https://github.com/ethereum-optimism/optimism/blob/3f4b3c328153a8aa03611158b6984d624b17c1d9/packages/contracts-bedrock/contracts/L1/SystemConfig.sol#L110-L126

Tool used

Manual Review

Recommendation

Add a control that makes initialize() only call the Deployer Contract or EOA

if (msg.sender != DEPLOYER_ADDRESS) {
    revert NotDeployer();
}