QA Report

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/InsuranceFund.sol#L34-L35

Vulnerability details

Impact

InsuranceFund's initialize doesn't seem to be able to run in the setup provided without initializer modifier, so the contract's ERC20 cannot be initialized, VUSD, marginAccount and governace cannot be set, the contract is inoperable

Proof of Concept

InsuranceFund's initialize calls ERC20Upgradeable's __ERC20_init, stating that it has initializer modifier:

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/InsuranceFund.sol#L34-L35

While actually __ERC20_init only has onlyInitializing modifier:

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/token/ERC20/ERC20Upgradeable.sol#L55-L62

That checks that initialization is taking place:

https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/proxy/utils/Initializable.sol#L72-L75

But it hasn't started and this way InsuranceFund's initialize have to fail all the times

Recommended Mitigation Steps

Consider adding initializer modifier (inherited from ERC20Upgradeable) to InsuranceFund's initialize:

Now:

function initialize(address _governance) external {
		__ERC20_init("Hubble-Insurance-Fund", "HIF"); // has initializer modifier
		_setGovernace(_governance);
}

To be:

function initialize(address _governance) external initializer {
		__ERC20_init("Hubble-Insurance-Fund", "HIF"); // has initializer modifier
		_setGovernace(_governance);
}

[atvanguard]

We are at openzep version 4.2.0 and hence isn't affected by this issue.

[JasoonS]

Confirmed not an issue at that version.

[JeeberC4]

Since this issue was downgraded to a QA level, and the warden did not submit a separate QA report, we've renamed this one to "QA report" for consistency.
The original title, for the record, was InsuranceFund initialize can't be run