Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Concrete>Informational findings>The BTCLinkedPriceFeed contract does not initialize the owner
GeneralOverview
Findings
High (2)
Medium (6)
Low (8)
Informational (9)The fees charged to the feeRecipient are inconsistent between functions deposit and mintThe BTCLinkedPriceFeed contract does not initialize the ownerInsufficient validation of _requestIdUnchecked return value in setParkingLotIncorrect withdrawable check in _withdrawStrategyFundsConcreteMultiStrategy should inherit from ReentrancyGuardUpgradeable instead of ReentrancyGuardIncorrect implementation of max functions in ConcreteMultiStrategyStrategy rewards accrue after the share price has been calculatedIncorrect use of the function _getRewardTokens to initialize the rewardTokens
DiscussionThe ConcreteOracle.getAssetPrice should ensure the returned price uses eight decimalsUnused _decimals variable in strategiesTest suite
DesignComponent: ControllerComponent: ConcreteMultiStrategyVaultComponent: WithdrawalComponent: Strategies
Audit ResultsAssessment Results
Category: Coding Mistakes

The BTCLinkedPriceFeed contract does not initialize the owner

Informational Impact
Informational Severity
N/A Likelihood

Description

The BTCLinkedPriceFeed contract inherits from the OwnableUpgradeable contract, but it does not call the function __Ownable_init during the initialization to initialize the owner.

Impact

The owner address will be the zero address after initialization. If there are functions with the onlyOwner modifier planned to be added into this contract, it is recommended to fix this issue.

Recommendations

Consider adding a call to the function __Ownable_init in the function initialize or removing the inherited contract OwnableUpgradeable.

Remediation

This issue has been acknowledged by Blueprint Finance, and a fix was implemented in commit 4d72bd74↗.

Zellic © 2025Back to top ↑