GasVault Manual Review Findings

GVT-01M: Inexistent Initialization of Base Implementation

Type	Severity	Location
Language Specific		GasVault.sol:L17-L22

Description:

The contract does not properly initialize the base logic implementation permitting it to be taken over by a malicious party.

Impact:

While not an active security threat, it can evolve into one if any form of delegatecall capability is introduced in one of the dependencies of the contract that could cause it to invoke a selfdestruct instruction.

Example:

Copy
17contract GasVault is
18    IGasVault,
19    Initializable,
20    OwnableUpgradeable,
21    UUPSUpgradeable
22{

Recommendation:

We advise a constructor to be introduced that simply invokes the initializer modifier to ensure that the logic implementation cannot be initialized maliciously.

Alleviation (200f275c40cbd4798f4a416c044ea726755d4741):

A constructor was introduced that properly invokes the initializer modifier and disallows initialization of the logic implementation, alleviating this exhibit in full.