DOS by Frontrunning BathHouse's initialize() Function

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/migrations/2_protocol.js#L13-L41
https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathHouse.sol#L97-L129

Vulnerability details

Impact

It's seen that the deployment scripts are ready to deploy RubiconMarket.sol, RubiconRouter.sol, BathHouse.sol.
And RubiconMarket is initialized at the time of deployment. However, BathHouse initialization is not done during deployment.It is important that the proxy contracts are deployed and initialized in the same transaction to avoid any malicious frontrunning.
As a result, a malicious attacker could monitor the Ethereum blockchain for bytecode that matches the BahtHouse contract and frontrun the initialize() transaction to gain ownership of the contract. This can be repeated as a Denial Of Service (DOS) type of attack, effectively preventing Rubicon's contract deployment, leading to unrecoverable gas expenses.

Proof of Concept

https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathHouse.sol#L97-L129
https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/migrations/2_protocol.js#L13-L41

Tools Used

Manual Review

Recommended Mitigation Steps

it would be worthwhile to ensure the BathHouse.sol contract is deployed and initialized in the same transaction, or ensure the initialize() function is callable only by the deployer of the BathHouse.sol contract.

[bghughes]

I believe this is low/no severity given that we will check all storage variables of the protocol via automated scripts to make sure the protocol is initialized correctly. If someone else called the initialize function, we would try again, and if front ran every time then an added storage variable for the appropriate caller would be added to ensure we can initialize the protocol correctly

[HickupHH3]

Agreed with sponsor, QA severity.

[HickupHH3]

Part of warden's QA report: #409