MadSisyphus - AssetFactory.sol proxy contract cannot be initialized

[sherlock-admin3]

MadSisyphus

High

AssetFactory.sol proxy contract cannot be initialized

Summary

The notDelegated modifier in the initialize function in the AssetFactory.sol contract prevents the proxy contract from being initialized. This means that the contract can not be used as it was intended, i.e. as an upgradeable contract to be called via an EIP-1967 proxy.

Vulnerability Detail

The AssetFactory.sol contract implements OpenZeppelin's UUPS (Universal Upgradeable Proxy Standard). It serves as the implementation contract which should be called by an EIP-1967 proxy using delegatecall. This means that contract initialization should happen also via delegatecall and state changes should happen on the proxy contract's state. However, in the AssetFactory.sol contract this is impossible because of the notDelegated modifier.

Impact

The AssetFactory.sol smart contract is unusable, because it cannot be initialized. This prevents Depeg Swaps and Cover Tokens from being created, and since they are some of the most important pillars of the protocol, this makes the whole protocol unusable.

Code Snippet

https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/core/assets/AssetFactory.sol#L48

Tool used

Manual Review

Recommendation

Remove the notDelegated modifier from the initalize function to allow the proxy contract to be initialized.

contract AssetFactory is IAssetFactory, OwnableUpgradeable, UUPSUpgradeable {
    ...
-     function initialize(address moduleCore) external initializer notDelegated {...}
+     function initialize(address moduleCore) external initializer {...}
}

Duplicate of #185