Lines of code

Vulnerability details

#Impact

// From https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/access/Ownable.sol

The current implementaion is using a non-upgradeable version of the Ownable library isnstead of the upgradeable version:
@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol.

A regular, non-upgradeable Ownable library will make the deployer the default owner in the constructor.
Due to a requirement of the proxy-based upgradeability system, no constructors can be used in upgradeable contracts.
Therefore, there will be no owner when the contract is deployed as a proxy contract

#Proof of Concept

	contract Position is Ownable, IPosition, MathUtil {

Tools Used

Manual review

Recommended Mitigation Steps

Use @openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol instead

The text was updated successfully, but these errors were encountered:

All reactions