Assessment reports>Beefy UniswapV3>Discussion>Initializers not called

Initializers are not called for cloned contracts

The factories' contracts offer the ability to clone contracts, which is a useful feature for the overall composability of the system. However, the initializers of the cloned contracts are not called on the spot, which may lead to unusable contracts, or even to security issues, should a malicious user call initialize() themselves.

  • The BeefyVaultConcLiqFactory has cloneVault(), where the BeefyVaultConcLiq vault is cloned. However, the initialize() function is not called after the cloning, which means that the vault is not properly initialized.

  • The StrategyFactory has createStrategy(), where the BeefyStrategy strategy is cloned. However, the initialize() function is not called after the cloning, which means that the strategy is not properly initialized.

We recommend ensuring that the initializers are called after the cloning of the contracts but in the same transaction. This will ensure that the contracts are properly initialized and usable.

Zellic © 2024Back to top ↑