MadSisyphus - Upgradeable contract AssetFactory.sol cannot be upgraded

[sherlock-admin2]

MadSisyphus

Medium

Upgradeable contract AssetFactory.sol cannot be upgraded

Summary

it is impossible to upgrade the AssetFactory.sol contract. This smart contract is a UUPS upgradeable contract, however because the overriden _authorizeUpgrade function contains the notDelegated modifier, it can not be upgraded.

Vulnerability Detail

_authorizeUpgrade is overridden as below:

   function _authorizeUpgrade(address newImplementation) internal override onlyOwner notDelegated {}

However, this UUPSUpgradeable OpenZeppelin smart contract only allows upgrades via a proxy:

function upgradeToAndCall(address newImplementation, bytes memory data) public payable virtual onlyProxy {...}

This inconsistency means it is impossible to upgrade the contract.

Impact

The AssetFactory.sol contract is locked in. This means if the protocol team later wants to update the implementation they are unable to do so, and they are stuck with the current implementation forever.

Code Snippet

https://github.com/sherlock-audit/2024-08-cork-protocol/blob/main/Depeg-swap/contracts/core/assets/AssetFactory.sol#L199

Tool used

Manual Review

Recommendation

Remove the notDelegated modifier from AssetFactory::_authorizeUpgrade

Duplicate of #185