Submitted by elprofesor, also found by kenzo
The unlock protocols base contract Unlock.sol uses setLocktemplate() to initialize the implementation contract for the PublicLock proxy. This function will initialize the relevant PublicLock contract which has been deployed separately. PublicLock.initialize() does not have any relevant access control and does not prevent arbitrary users from initialising. This means that a malicious user could front run the setLocktemplate() forcing the deployer of PublicLocks implementation to redeploy. The process can be repeated, which costs the malicious user less than it would the owner of the Unlock Protocol, potentially unnecessarily draining funds from the development team.
Lack of access control on initialize
Implement valid access control on the PublicLock contract to ensure only the relevant deployer can initialize().
julien51 (Unlock Protocol) disagreed with severity
0xleastwood (judge) commented:
