Wrong and unexpected parameters passed to constructor in KatanaV3PoolProxy.

[howlbot-integration]

Lines of code

https://github.com/ronin-chain/katana-v3-contracts/blob/03c80179e04f40d96f06c451ea494bb18f2a58fc/src/core/KatanaV3PoolProxy.sol#L11

Vulnerability details

Description

This KatanaV3PoolProxy contract have a constructor with parameter as address(0) passed to beaconProxy contract which further _setBeacon with zero address. This address(0) is passed as beacon address to beaconProxy and then beaconProxy contract's constructor call _setBeacon function with address(0) as beacon. This _setBeacon function has a check which revert this call require(Address.isContract(beacon),"BeaconProxy: beacon is not a contract");.

Impact

KatanaV3PoolProxy contract always revert on deployment, restricted code or dead contract. Because this can never be initialized.

Proof of Concepts

• address(0) passed from KatanaV3PoolProxy contract:
  constructor() BeaconProxy(address(0), "") { }

• BeaconProxy's Contructor called _setBeacon:

constructor(address beacon, bytes memory data) payable {
       assert(_BEACON_SLOT == bytes32(uint256(keccak256("eip1967.proxy.beacon")) - 1));
       _setBeacon(beacon, data);
   }

• _setBeacon requires checks:

function _setBeacon(address beacon, bytes memory data) internal virtual {
        require(
            Address.isContract(beacon),
            "BeaconProxy: beacon is not a contract"
        );

• So address(0) can't be a contract's address, It reverts.

Assessed type

Other

[c4-judge]

alex-ppg marked the issue as unsatisfactory:
Invalid