UUPSUpgradeable vulnerability in OpenZeppelin Contracts
Openzeppelin has found the critical severity bug in UUPSUpgradeable. The kyber-swap contracts has used both openzeppelin contracts as well as openzeppelin upgrabable contracts with version v4.3.1. This is confirmed from package.json.\\n```\\nFile: ks-elastic-sc/package.json\\n\\n    "@openzeppelin/contracts": "4.3.1",\\n    "@openzeppelin/test-helpers": "0.5.6",\\n    "@openzeppelin/contracts-upgradeable": "4.3.1",\\n```\\n\\nThe `UUPSUpgradeable` vulnerability has been found in openzeppelin version as follows,\\n@openzeppelin/contracts : Affected versions >= 4.1.0 < 4.3.2 @openzeppelin/contracts-upgradeable : >= 4.1.0 < 4.3.2\\nHowever, openzeppelin has fixed this issue in versions 4.3.2\\nOpenzeppelin bug acceptance and fix: check here\\nThe following contracts has been affected due to this vulnerability\\nPoolOracle.sol\\nTokenPositionDescriptor.sol\\nBoth of these contracts are UUPSUpgradeable and the issue must be fixed.
Update the openzeppelin library to latest version.\\nCheck this openzeppelin security advisory to initialize the UUPS implementation contracts.\\nCheck this openzeppelin UUPS documentation.
Upgradeable contracts using UUPSUpgradeable may be vulnerable to an attack affecting uninitialized implementation contracts.
```\\nFile: ks-elastic-sc/package.json\\n\\n    "@openzeppelin/contracts": "4.3.1",\\n    "@openzeppelin/test-helpers": "0.5.6",\\n    "@openzeppelin/contracts-upgradeable": "4.3.1",\\n```\\n