search

sherlock-audit / 2023-04-footium-judging

13 stars 7 forks source link

SanketKogekar - In `FootiumGeneralPaymentContract`, set `footiumClub` contract address to be immutable. #385

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

SanketKogekar

medium

In FootiumGeneralPaymentContract, set footiumClub contract address to be immutable.

Summary

The footiumClub is never set to a new value but is not made to be immutable either.

Vulnerability Detail

Since the contracts are designed to be upgradeable, its important to make sure no changes are made which can break exisiting functionality.

Make sure below variable is immutable, so it can only be set from constructor/initializer.

IFootiumClub public footiumClub;

Impact

footiumClub address could be changed accidentally in future contract upgrades, which is a very common mistake.

Code Snippet

https://github.com/sherlock-audit/2023-04-footium/blob/main/footium-eth-shareable/contracts/FootiumGeneralPaymentContract.sol#L19-L20

Tool used

Manual Review

Recommendation

Consider changing the line to -

IFootiumClub public immutable footiumClub;