Initializers are not called for cloned contracts
The factories' contracts offer the ability to clone contracts, which is a useful feature for the overall composability of the system. However, the initializers of the cloned contracts are not called on the spot, which may lead to unusable contracts, or even to security issues, should a malicious user call initialize()
themselves.
The BeefyVaultConcLiqFactory has
cloneVault()
, where theBeefyVaultConcLiq
vault is cloned. However, theinitialize()
function is not called after the cloning, which means that the vault is not properly initialized.The StrategyFactory has
createStrategy()
, where theBeefyStrategy
strategy is cloned. However, theinitialize()
function is not called after the cloning, which means that the strategy is not properly initialized.
We recommend ensuring that the initializers are called after the cloning of the contracts but in the same transaction. This will ensure that the contracts are properly initialized and usable.