Challenge 15

tx.origin Misuse

HighUpgradeable contracts

Challenge

This wallet is intended to work behind a proxy. Review how its admin is initialized and protected.

Starter code

// Intended to be upgradeable via proxy
pragma solidity ^0.8.0;

contract AdminWallet {
  address public admin;

  constructor() {
    admin = msg.sender;
  }

  function withdraw(address payable to, uint256 amount) public {
    require(msg.sender == admin, "Not authorized");
    to.transfer(amount);
  }

  receive() external payable {}
}

Show hint

Proxy storage is not initialized by the implementation contract's constructor. Use a protected initializer.