Lines of code

Vulnerability details

Since proxied contracts do not make use of a constructor, it’s common to move constructor logic to an external initializer function, usually called initialize. It then becomes necessary to protect this initializer function so it can only be called once.

The solution uses:
“@openzeppelin/contracts”: “^4.2.0”,
“@openzeppelin/contracts-upgradeable”: “^4.2.0”,

Proof of Concept

These dependencies have a known high-severity vulnerability:

<https://security.snyk.io/vuln/SNYK-JS-OPENZEPPELINCONTRACTSUPGRADEABLE-2320177&gt;

<https://snyk.io/test/npm/@openzeppelin/contracts-upgradeable/4.3.2#SNYK-JS-OPENZEPPELINCONTRACTSUPGRADEABLE-2320177&gt;

<https://snyk.io/test/npm/@openzeppelin/contracts/4.0.0#SNYK-JS-OPENZEPPELINCONTRACTS-2320176&gt;

Which makes these contracts vulnerable:

PoolConfigurator.sol#L76.

76: function initialize(IPoolAddressesProvider provider) external initializer {

MockInitializableImplementation.sol#L25.

25: ) external initializer {

WETHGateway.sol#L39.

39: function initialize() external initializer {

WPunkGateway.sol#L57.

57: function initialize() external initializer

Recommended Mitigation Steps

Upgrade @openzeppelin/contracts and @openzeppelin/contracts-upgradeable to version 4.4.1 or higher.

---

The text was updated successfully, but these errors were encountered:

All reactions