criticalAccess controlEVM-Solidity
Most Aleph Zero Bridge: Attacker can initialize `Most.sol` to set critical parameters
- Payout
- $0
- Protocol
- Most Aleph Zero Bridge
- Disclosed
- Mar 19, 2024
- Source
- hats
Most.sol, an upgradeable OpenZeppelin-based bridge contract, exposes an initialize() function with the initializer modifier but no constructor-level lock, leaving both the proxy and the uninitialized implementation open to takeover. Because any caller can invo …
Similar reports
- No close matches yet.
References
- https://github.com/hats-finance/Most--Aleph-Zero-Bridge-0xab7c1d45ae21e7133574746b2985c58e0ae2e61d/issues/4
- https://github.com/hats-finance/Most--Aleph-Zero-Bridge-0xab7c1d45ae21e7133574746b2985c58e0ae2e61d
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.