Livepeer contest - cccz's results

Handle

cccz

Vulnerability details

Impact

In the DelegatorPool contract, the initialize function was missing access controls, allowing any user to initialize the contract. By front-running the contract deployers to initialize the contract, the incorrect parameters may be supplied, leaving the contract needing to be redeployed.

    function initialize(address _bondingManager) public initializer {
        bondingManager = _bondingManager;
        migrator = msg.sender;
        initialStake = pendingStake();
    }

Proof of Concept

https://github.com/livepeer/arbitrum-lpt-bridge/blob/main/contracts/L2/pool/DelegatorPool.sol#L47-L51

Tools Used

Manual analysis

Recommended Mitigation Steps

Setting the owner in the contract's constructor to the msg.sender and adding the onlyOwner modifier to all initializers