Merge pull request #52 from yieldnest/chad/sc-319/audit-6-10-disable-initializers

Fix Audit 6.10 Disable initializers

Author: danoctavian

src/RewardsReceiver.sol

@@ -31,6 +31,10 @@ contract RewardsReceiver is Initializable, AccessControlUpgradeable {
     //----------------------------------  INITIALIZATION  ----------------------------------
     //--------------------------------------------------------------------------------------
 
+    constructor() {
+        _disableInitializers();
+    }
+
     /// @notice Configuration for contract initialization.
     struct Init {
         address admin;

src/ynETH.sol

@@ -57,8 +57,7 @@ contract ynETH is IynETH, ynBase, IStakingEvents {
         address[] pauseWhitelist;
     }
 
-    constructor(
-    ) {
+    constructor() {
          _disableInitializers();
     }
 

test/foundry/integration/IntegrationBaseTest.sol

@@ -103,21 +103,34 @@ contract IntegrationBaseTest is Test, Utils {
         TransparentUpgradeableProxy rewardsDistributorProxy;
         TransparentUpgradeableProxy stakingNodesManagerProxy;
         TransparentUpgradeableProxy yieldNestOracleProxy;
+        TransparentUpgradeableProxy executionLayerReceiverProxy;
+        TransparentUpgradeableProxy consensusLayerReceiverProxy;
+
         // Initializing RewardsDistributor contract and creating its proxy
         rewardsDistributor = new RewardsDistributor();
         yneth = new ynETH();
         stakingNodesManager = new StakingNodesManager();
         yieldNestOracle = new YieldNestOracle();
         ynlsd = new ynLSD();
 
+        executionLayerReceiver = new RewardsReceiver();
+        consensusLayerReceiver = new RewardsReceiver();
+
         rewardsDistributorProxy = new TransparentUpgradeableProxy(address(rewardsDistributor), actors.PROXY_ADMIN_OWNER, "");
         rewardsDistributor = RewardsDistributor(payable(rewardsDistributorProxy));
 
+
         ynethProxy = new TransparentUpgradeableProxy(address(yneth), actors.PROXY_ADMIN_OWNER, "");
         stakingNodesManagerProxy = new TransparentUpgradeableProxy(address(stakingNodesManager), actors.PROXY_ADMIN_OWNER, "");
         yieldNestOracleProxy = new TransparentUpgradeableProxy(address(yieldNestOracle), actors.PROXY_ADMIN_OWNER, "");
         ynLSDProxy = new TransparentUpgradeableProxy(address(ynlsd), actors.PROXY_ADMIN_OWNER, "");
 
+        executionLayerReceiverProxy = new TransparentUpgradeableProxy(address(executionLayerReceiver), actors.PROXY_ADMIN_OWNER, "");
+        consensusLayerReceiverProxy = new TransparentUpgradeableProxy(address(consensusLayerReceiver), actors.PROXY_ADMIN_OWNER, "");
+
+        executionLayerReceiver = RewardsReceiver(payable(executionLayerReceiverProxy));
+        consensusLayerReceiver = RewardsReceiver(payable(consensusLayerReceiverProxy));
+
         // Wrapping proxies with their respective interfaces
         yneth = ynETH(payable(ynethProxy));
         stakingNodesManager = StakingNodesManager(payable(stakingNodesManagerProxy));
@@ -173,17 +186,7 @@ contract IntegrationBaseTest is Test, Utils {
     }
 
     function setupRewardsDistributor() public {
-        executionLayerReceiver = new RewardsReceiver();
-        consensusLayerReceiver = new RewardsReceiver();
-        RewardsDistributor.Init memory rewardsDistributorInit = RewardsDistributor.Init({
-            admin: actors.ADMIN,
-            executionLayerReceiver: executionLayerReceiver,
-            consensusLayerReceiver: consensusLayerReceiver,
-            feesReceiver: payable(actors.FEE_RECEIVER),
-            ynETH: IynETH(address(yneth))
-        });
 
-        rewardsDistributor.initialize(rewardsDistributorInit);
         RewardsReceiver.Init memory rewardsReceiverInit = RewardsReceiver.Init({
             admin: actors.ADMIN,
             withdrawer: address(rewardsDistributor)
@@ -192,6 +195,15 @@ contract IntegrationBaseTest is Test, Utils {
         executionLayerReceiver.initialize(rewardsReceiverInit);
         consensusLayerReceiver.initialize(rewardsReceiverInit);
         vm.stopPrank();
+
+        RewardsDistributor.Init memory rewardsDistributorInit = RewardsDistributor.Init({
+            admin: actors.ADMIN,
+            executionLayerReceiver: executionLayerReceiver,
+            consensusLayerReceiver: consensusLayerReceiver,
+            feesReceiver: payable(actors.FEE_RECEIVER),
+            ynETH: IynETH(address(yneth))
+        });
+        rewardsDistributor.initialize(rewardsDistributorInit);
     }
 
     function setupStakingNodesManager() public {

test/foundry/integration/StakingNodesManager.t.sol

@@ -505,11 +505,17 @@ contract StakingNodesManagerValidators is IntegrationBaseTest {
         (IStakingNodesManager.ValidatorData[] memory validatorData,) = makeTestValidators(depositAmount);
         // try to create a bad deposit root
         bytes32 depositRoot = depositContractEth2.get_deposit_root();
+        bytes memory withdrawalCredentials = stakingNodesManager.getWithdrawalCredentials(validatorData[0].nodeId);
 
+        bytes32 depositDataRoot = stakingNodesManager.generateDepositRoot(
+            validatorData[0].publicKey, 
+            validatorData[0].signature, 
+            withdrawalCredentials, 32 ether
+        );
         vm.prank(actors.VALIDATOR_MANAGER);
         vm.expectRevert(abi.encodeWithSelector(
             StakingNodesManager.DepositDataRootMismatch.selector, 
-            0x7be1a5aee0180c84f2d1b0ef721fb62bf323ee9aabeac0bd5bb551da1782f805, 
+            depositDataRoot, 
             validatorData[0].depositDataRoot)
         );
         stakingNodesManager.registerValidators(depositRoot, validatorData);