Initializer Can be Reinitialized

[code423n4]

JOYN Contest

April 1, 2022

@securerodd

Findings

Low Risk Findings

1. Initializer Can be Reinitialized

The initializer function in CoreCollection.sol does not contain the onlyUnInitialized() modifier.

Code:

function initialize(
    string memory _collectionName,
    string memory _collectionSymbol,
    string memory _collectionURI,
    uint256 _maxSupply,
    uint256 _mintFee,
    address _payableToken,
    bool _isForSale,
    address _splitFactory
    ) external onlyOwner onlyValidSupply(_maxSupply) {
        _name = _collectionName;
        _symbol = _collectionSymbol;
        _baseUri = _collectionURI;
        maxSupply = _maxSupply;
        mintFee = _mintFee;
        payableToken = IERC20(_payableToken);
        isForSale = _isForSale;
        splitFactory = _splitFactory;
        initialized = true;
    }

The onlyUnInitialized() modifier is currently unused in the code base. In CoreFactory.sol, Core Collections are deployed by an EOA or contract interacting with the Core Factory itself. Without the modifier, these owners have the ability to completely reconfigure key aspects of the collection.

Recommendation:

Apply the onlyUnInitialized() modifier to the initializer function in CoreCollection.sol.

[sofianeOuafir]

In my opinion, the severity level should be 3 (High Risk)

duplicate of #4