017.md

0x0

high

Constructor Usage For Upgradable Contract

Summary

Upgradable contracts must not use traditional constructors.

Vulnerability Detail

MarketExtended has a constructor. State that is set via a traditional constructor will not be executed within the context of the contract.

Impact

• State set at deployment time will not be valid in the context of the contract for market storage.

Code Snippet

constructor(address _paymentToken, IRegistry _registry) initializer MarketStorage(_paymentToken, _registry) {}

Tool used

Manual Review

Recommendation

• Assign the MarketStorage state within the initialize() function