Unprotected Initialization Function in Smart Contract Leads to Potential Race Condition Vulnerability

Screenshot 2024-05-31 181951

Summary

The initialization functions in the smart contract are vulnerable to a race condition where an unauthorized party can call the initialize function before the legitimate owner, leading to the possibility of setting critical parameters and addresses incorrectly. This issue arises because the initialize function lacks proper access control, allowing any address to call it.

Vulnerability Detail

The deposit contract and redemption contract has initialize functions used to set up the contract's state variables and initialize the inherited ManageableVault contract. However, these functions lack access control, which means any address can call them. This is particularly problematic if the contract is deployed using a proxy pattern, where the deployment and initialization occur in separate transactions. An attacker could exploit this gap by calling the initialize function before the legitimate deployer does, setting the addresses and other parameters to values controlled by the attacker.

Impact

The lack of access control on the initialize functions can lead to the following issues:

Unauthorized Initialization: An attacker can set critical contract parameters to malicious values. Loss of Control: The legitimate deployer loses control over the contract configuration, leading to potential loss of funds or incorrect contract behavior.

Code Snippet

https://github.com/sherlock-audit/2024-05-midas/blob/main/midas-contracts/contracts/DepositVault.sol#L70 https://github.com/sherlock-audit/2024-05-midas/blob/main/midas-contracts/contracts/RedemptionVault.sol#L48

   function initialize(
        address _ac,
        address _mTBILL,
        address _eurUsdDataFeed,
        uint256 _minAmountToDepositInEuro,
        address _usdReceiver
    ) external initializer {
        require(_eurUsdDataFeed != address(0), "zero address");
// ac, mtbill, usd reciever , sets greenlist, pausable to account
        __ManageableVault_init(_ac, _mTBILL, _usdReceiver);
        minAmountToDepositInEuro = _minAmountToDepositInEuro;
        eurUsdDataFeed = IDataFeed(_eurUsdDataFeed);
    }

  function initialize(
        address _ac,
        address _mTBILL,
        address _tokensReceiver
    ) external initializer {
        __ManageableVault_init(_ac, _mTBILL, _tokensReceiver);
    }

Tool used

Manual Review

Recommendation

To mitigate this vulnerability, restrict access to the initialize functions using a modifier that ensures only a specific address (typically the deployer or an owner) can call them.

sherlock-audit / 2024-05-midas-judging

recursiveEth - Unprotected Initialization Function in Smart Contract Leads to Potential Race Condition Vulnerability #154