Platform: Code4rena
Start Date: 18/11/2021
Pot Size: $50,000 USDC
Total HM: 18
Participants: 26
Period: 7 days
Judge: leastwood
Total Solo HM: 12
Id: 54
League: ETH
Rank: 14/26
Findings: 2
Award: $405.50
🌟 Selected for report: 1
🚀 Solo Findings: 0
Jujic
At line: https://github.com/code-423n4/2021-11-unlock/blob/ec41eada1dd116bcccc5603ce342257584bec783/smart-contracts/contracts/Unlock.sol#L211
use external instead of public modifier
I recommend using external instead of public modifier for createLock function because it is not called internally.
#0 - 0xleastwood
2022-01-17T08:11:54Z
Agree!
#1 - 0xleastwood
2022-01-17T08:50:59Z
Duplicate of #196
🌟 Selected for report: Jujic
Jujic
The function initializeProxyAdmin() can be called by anyone the first time which allows an attacker to set the ProxyAdmin of the contract to themselves, leading to a denial of service attack.
Add access modifier.
#0 - julien51
2022-01-03T15:11:53Z
If this was front-run we could easily re-deploy anyway?
#1 - 0xleastwood
2022-01-16T11:57:03Z
Agree with warden here. This can cause unintended consequences. It makes sense to call initializeProxyAdmin() from within initialize().