Init function can be called by everyone about 2021-04-vader-findings

[strictly-scarce]

Yes, but only once. Could add a deployer check tho

[dmvt]

After considerable evaluation and seeing the wide range of threat factors that were put forward by wardens related to this issue, I've decided that the potential threat here does extend beyond gas.

A worst case scenario could cause significant damage.

It is extremely unlikely that an attacker could successfully time this type of attack.

An attacker would have to successfully intercept more than one init due to the highly coupled nature of the contract. If they did so incorrectly, the entire system would not function. Presuming they succeeded, the team would also have to overlook the failure of or forget to make multiple critical transaction calls in their deployment scripts. To realize significant financial gains, the attacker would have to leave their exploit code in place for an extended period of time.

The likelihood is extremely low, but the impact would be critical. For this reason, I'm normalizing all of these reports to a Medium Risk.