Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-02·

Missing `_disableInitializers()` in implementation contract

Not reportedoptionsleverageblack-scholes
TL;DR

The Oracle contract inherits from UUPSUpgradeable and uses an initializer pattern, but it does not disable initializers in its constructor.

Severity
LOW
Method
MManual review
CAT.

The Oracle contract inherits from UUPSUpgradeable and uses an initializer pattern, but it does not disable initializers in its constructor.

solidity
# The current implementation only has an init function:
function init(address owner) public initializer {
_grantRole(AccessControlStorage.DEFAULT_ADMIN_ROLE, owner);
}

Without _disableInitializers() in the constructor, there's a risk that someone could initialize the implementation contract directly, which could lead to unexpected behavior or potential security issues.

To mitigate this issue, it is recommended to add _disableInitializers() in the constructor of the implementation contract.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-02