Omniscia Congruent Audit

RewardDistributor Manual Review Findings

RewardDistributor Manual Review Findings

RDR-01M: Inexistent Initialization of UUPS Dependency

Description:

The UUPS dependency remains uninitialized in the proxy implementation.

Example:

contracts/RewardDistributor.sol
38function initialize(
39    IERC20 _cvxCRV,
40    IERC20 _cCRV,
41    IERC20 _crv,
42    IERC20 _cvx,
43    IPool _cCRVPool,
44    IPool _cvxPool,
45    IcvxCrvDepositor _depositor,
46    IConvexCrvDepositor _crvDepositor
47) external initializer {
48    __Ownable_init();
49

50    cvxCRV = _cvxCRV;
51    cCRV = _cCRV;
52    crv = _crv;
53    cvx = _cvx;
54    cCRVPool = _cCRVPool;
55    cvxPool = _cvxPool;
56    cxvCrvDepositor = _depositor;
57    crvDepositor = _crvDepositor;
58

59    setApprove();
60}

Recommendation:

Although it currently bears no impact, we advise it to be initialized to ensure future upgrades do not break its functionality by invoking the __UUPSUpgradeable_init function.

Alleviation:

The UUPS dependency is now properly initialized in the initialize hook of the contract.

Prev

MasterChef.sol (MCF-M)

Next

cCRV.sol (CRV-M)

On this page