Missing `_disableInitializers()` in implementation contract
The Oracle contract inherits from UUPSUpgradeable and uses an initializer pattern, but it does not disable initializers in its constructor.
The Oracle contract inherits from UUPSUpgradeable and uses an initializer pattern, but it does not disable initializers in its constructor.
# The current implementation only has an init function:function init(address owner) public initializer {_grantRole(AccessControlStorage.DEFAULT_ADMIN_ROLE, owner);}
Without _disableInitializers() in the constructor, there's a risk that someone could initialize the implementation contract directly, which could lead to unexpected behavior or potential security issues.
To mitigate this issue, it is recommended to add _disableInitializers() in the constructor of the implementation contract.
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.