RocketDAOProtocolSettings/RocketDAONodeTrustedSettings - anyone can set/overwrite settings until contract is declared “deployed”  Acknowledged
The `onlyDAOProtocolProposal` modifier guards all state-changing methods in this contract. However, analog to https://github.com/ConsenSys/rocketpool-audit-2021-03/issues/7, the access control is disabled until the variable `settingsNameSpace.deployed` is set. If this contract is not deployed and configured in one transaction, anyone can update the contract while left unprotected on the blockchain.\\nSee issue 6.5 for a similar issue.\\n```\\nmodifier onlyDAOProtocolProposal() {\\n    // If this contract has been initialised, only allow access from the proposals contract\\n    if(getBool(keccak256(abi.encodePacked(settingNameSpace, "deployed")))) require(getContractAddress('rocketDAOProtocolProposals') == msg.sender, "Only DAO Protocol Proposals contract can update a setting");\\n    \\_;\\n}\\n```\\n\\n```\\nmodifier onlyDAONodeTrustedProposal() {\\n    // If this contract has been initialised, only allow access from the proposals contract\\n    if(getBool(keccak256(abi.encodePacked(settingNameSpace, "deployed")))) require(getContractAddress('rocketDAONodeTrustedProposals') == msg.sender, "Only DAO Node Trusted Proposals contract can update a setting");\\n    \\_;\\n}\\n```\\n\\nThere are at least 9 more occurrences of this pattern.
Restrict access to the methods to a temporary trusted account (e.g. guardian) until the system bootstrapping phase ends by setting `deployed` to `true.`
```\\nmodifier onlyDAOProtocolProposal() {\\n    // If this contract has been initialised, only allow access from the proposals contract\\n    if(getBool(keccak256(abi.encodePacked(settingNameSpace, "deployed")))) require(getContractAddress('rocketDAOProtocolProposals') == msg.sender, "Only DAO Protocol Proposals contract can update a setting");\\n    \\_;\\n}\\n```\\n