FloatToken would revoke stakerAddress's permission if msg.sender == stakerAddress

[code423n4]

Handle

jonah1005

Vulnerability details

Impact

FloatToken would revoke staker's permission if msg.sender == stakerAddress.
In initializeFloatToken the contract would first grant roles to stakerAddress and than revokemsg.sender's permissions. The contract would be left with no privileged address if stakerAddress == msg.sender.

Proof of Concept

https://github.com/code-423n4/2021-08-floatcapital/blob/main/contracts/contracts/FloatToken.sol#L21-L35

Tools Used

None

Recommended Mitigation Steps

  function initializeFloatToken(
    string calldata name,
    string calldata symbol,
    address stakerAddress
  ) external initializer {
    initialize(name, symbol);

    renounceRole(DEFAULT_ADMIN_ROLE, msg.sender);
    renounceRole(MINTER_ROLE, msg.sender);
    renounceRole(PAUSER_ROLE, msg.sender);
  
    _setupRole(DEFAULT_ADMIN_ROLE, stakerAddress);
    _setupRole(MINTER_ROLE, stakerAddress);
    _setupRole(PAUSER_ROLE, stakerAddress);
  }

[JasoonS]

I see, yes, then it would revert. Clever. Agree this is Non-critical, zero plan ever for the staker to deploy this contract.

Thanks.

[JasoonS]

Put permission setup for synthetic token in the initializer for the synthetic token rather. Cleaner that way.