Potentially Uninitialized Implementations
Most contracts in the system are meant to be used with a proxy pattern. First, the implementations are deployed, and then proxies are deployed that delegatecall into the respective implementations following an initialization call (hardhat, with same transaction). However, the implementations are initialized explicitly nor are they protected from other actors claiming/initializing them. This allows anyone to call initialization functions on implementations for use with phishing attacks (i.e. contract implementation addresses are typically listed on the official project website as valid contracts) which may affect the reputation of the system.\\nNone of the implementations allow unprotected delegatecalls or selfdesturcts. lowering the severity of this finding.\\n```\\nfunction initialize\\_1(\\n address \\_admin,\\n address \\_treasury,\\n address \\_depositContract,\\n address \\_elDispatcher,\\n address \\_clDispatcher,\\n address \\_feeRecipientImplementation,\\n uint256 \\_globalFee,\\n uint256 \\_operatorFee,\\n uint256 globalCommissionLimitBPS,\\n uint256 operatorCommissionLimitBPS\\n) external init(1) {\\n```\\n\\n```\\n/// @notice Initializes the receiver\\n/// @param \\_dispatcher Address that will handle the fee dispatching\\n/// @param \\_publicKeyRoot Public Key root assigned to this receiver\\nfunction init(address \\_dispatcher, bytes32 \\_publicKeyRoot) external {\\n if (initialized) {\\n revert AlreadyInitialized();\\n }\\n initialized = true;\\n dispatcher = IFeeDispatcher(\\_dispatcher);\\n publicKeyRoot = \\_publicKeyRoot;\\n stakingContract = msg.sender; // The staking contract always calls init\\n}\\n```\\n\\n```\\n/// @param \\_publicKeyRoot Public Key root assigned to this receiver\\nfunction init(address \\_dispatcher, bytes32 \\_publicKeyRoot) external {\\n if (initialized) {\\n revert AlreadyInitialized();\\n }\\n initialized = true;\\n dispatcher = IFeeDispatcher(\\_dispatcher);\\n publicKeyRoot = \\_publicKeyRoot;\\n}\\n```\\n
Petrify contracts in the constructor and disallow other actors from claiming/initializing the implementations.
```\\nfunction initialize\\_1(\\n address \\_admin,\\n address \\_treasury,\\n address \\_depositContract,\\n address \\_elDispatcher,\\n address \\_clDispatcher,\\n address \\_feeRecipientImplementation,\\n uint256 \\_globalFee,\\n uint256 \\_operatorFee,\\n uint256 globalCommissionLimitBPS,\\n uint256 operatorCommissionLimitBPS\\n) external init(1) {\\n```\\n