Submitted by Dravee
https://github.com/code-423n4/2022-02-hubble/blob/main/package.json#L17
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/legos/Governable.sol#L5
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/legos/Governable.sol#L24
While Governable.sol is out of scope, I figured this issue would still be fair game.
The solution uses: "@openzeppelin/contracts": "4.2.0".
This dependency has a known high severity vulnerability: https://security.snyk.io/vuln/SNYK-JS-OPENZEPPELINCONTRACTS-2320176
Which makes this contract vulnerable:
This contract is inherited at multiple places:
nitializer()` is used here:
Upgrade @openzeppelin/contracts to version 4.4.1 or higher.
atvanguard (Hubble) confirmed and resolved
moose-code (judge) commented:
