require nextId to be zero will always revert due to nextId already initialized to 1

[howlbot-integration]

Lines of code

https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/periphery/NonfungiblePositionManager.sol#L104

Vulnerability details

In NonfungiblePositionManager.sol there will be a problem initializing.

  /// @dev The ID of the next token that will be minted. Skips 0
  uint176 private _nextId = 1;
  /// @dev The ID of the next pool that is used for the first time. Skips 0
  uint80 private _nextPoolId = 1;

https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/periphery/NonfungiblePositionManager.sol#L83

_nextId is initialized to 1 in state variable declaration

  function initialize() external {
    require(_nextId == 0, "Already initialized");

    _nextId = 1;
    _nextPoolId = 1;
  }

https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/periphery/NonfungiblePositionManager.sol#L104

Initialize function checks if it's 0

This means that the check will always fail to initialize

Recommended Mitigation Steps

  function initialize() external {
    require(_nextId == 1, "Already initialized");

    _nextId = 1;
    _nextPoolId = 1;
  }

Chnage the require statement to check for _nextId == 1

Assessed type

Error

[khangvv]

The NonfungiblePositionManager contract functions as a transparent proxy, leaving its private state variables uninitialized (set to 0). Therefore, the initialize function is necessary and will succeed on its first call.

[alex-ppg]

This submission is similar to the #26 issue class and the same rationale applies here.

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid