Masterchef's constructor sets _voter in the implementation storage, not the proxy storage.
Summary
Vulnerability Detail
The constructor for Masterchef attempts to set the _voter in the constructor, while the parameter is a storage (not an immutable).
This will cause the proxy to not have a _voter at all, because the voter is set in the storage of the implementation contract, not the proxy contract.
We recognize this is Low/Info because this was likely done to address the circular deployment dependency for Masterchef and Voter (one needs the other in constructor), and that there is a function setVoter().
Icy Basil Seal
Low/Info
Masterchef's constructor sets _voter in the implementation storage, not the proxy storage.
Summary
Vulnerability Detail
The constructor for
Masterchefattempts to set the_voterin the constructor, while the parameter is a storage (not an immutable).This will cause the proxy to not have a
_voterat all, because the voter is set in the storage of the implementation contract, not the proxy contract.We recognize this is Low/Info because this was likely done to address the circular deployment dependency for
MasterchefandVoter(one needs the other in constructor), and that there is a functionsetVoter().Impact
Code Snippet
https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MasterchefV2.sol#L87
Tool used
Manual Review
Recommendation