VaultRegistry Manual Review Findings

VRY-01M: Inexistent Initialization of Base Implementation

Type	Severity	Location
Language Specific		VaultRegistry.sol:L32-L37

Description:

The contract does not properly initialize the base logic implementation permitting it to be taken over by a malicious party.

Impact:

While not an active security threat, it can evolve into one if any form of delegatecall capability is introduced in one of the dependencies of the contract that could cause it to invoke a selfdestruct instruction.

Example:

Copy
32contract VaultRegistry is
33    Initializable,
34    UUPSUpgradeable,
35    PausableUpgradeable,
36    InterfaceManager
37{

Recommendation:

We advise a constructor to be introduced that simply invokes the initializer modifier to ensure that the logic implementation cannot be initialized maliciously.

Alleviation (200f275c40cbd4798f4a416c044ea726755d4741):

A constructor was introduced that properly invokes the initializer modifier and disallows initialization of the logic implementation, alleviating this exhibit in full.