Skip to main content

Delegated spending should not require owner auth

Description​

Since version 22.0.0 of the Soroban CLI, constructors are supported to automatically initialize contracts the moment they're deployed. Use constructors instead of initializers.

Why is this bad?​

Initializers are error-prone and subject to unauthorized initializations, where someone other than the person who deployed the contract calls the initializer, taking control of the deployment and requiring a second deployment. A more serious issue is that initializer logic is easy to get wrong, especially with regards to preventing double initialization. Constructors solve both of these issues automatically by handing the responsibility over to the blockchain.

Issue example​

pub fn init(env: Env, admin: Address) {
	admin.require_auth();
	// Store admin in the contract.
}

The code example can be found here.

Remediated example​

pub fn __constructor(env: Env, admin: Address) {
	admin.require_auth();
	// Store admin in the contract.
}

The remediated code example can be found here.

How is it detected?​

The detectos looks for functions named with common initializer names (init and initialize) and suggests a renaming to __constructor.