PanopticFactory::initialize is not protected

[c4-bot-10]

Lines of code

https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/PanopticFactory.sol#L134

Vulnerability details

Impact

PanopticFactory::initialize is not protected, so it could be front-run and called by anyone during the deployment phase.

Proof of Concept

The PanopticFactory::initialize is not protected. Thus during the deployment phase, it could be front-run and called by anyone to become the owner of the Factory.

    function initialize(address _owner) public {
        if (!s_initialized) {
            s_owner = _owner;
            s_initialized = true;
        }
    }

Since owner has the privilege to deploy new pools, the original-intended user could be DoSed from calling deployNewPool.

Tools Used

Manual

Recommended Mitigation Steps

To mitigate, it is better to set the s_owner in the constructor to avoid unnecessary front-run.

Assessed type

Access Control

[c4-judge]

Picodes marked the issue as duplicate of #523

[c4-judge]

Picodes changed the severity to QA (Quality Assurance)