Update initializer modifier to prevent reentrancy during initialization.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/package.json#L14
https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L35-L35

Vulnerability details

Impact

It is possible for initializer() protected functions to be executed twice, if this happens in the same transaction. For this to happen, either one call has to be a subcall to the other, or both calls have to be subcalls of a common initializer() protected function. This can be particularly dangerous if the initialization is not part of the proxy construction, and reentrancy is possible by executing an external call to an untrusted address.
https://snyk.io/test/npm/@openzeppelin/contracts/3.4.2-solc-0.7#SNYK-JS-OPENZEPPELINCONTRACTS-2320176

Proof of Concept

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/package.json#L14

    "@openzeppelin/contracts": "^3.4.2-solc-0.7",

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L35-L35

    function initialize(uint16 currencyId, uint40 maturity) external override initializer {

Tools Used

Manual.

Recommended Mitigation Steps

Upgrade to @openzeppelin/contracts@4.4.1+.

[berndartmueller]

Duplicate #145

Brownie is used to install dependencies and compile the contracts, using this outdated version declared in the package.json does not impose any risks qualified as medium severity.

I submitted this finding as low in #215 - [L-08] Contracts are using outdated OpenZeppelin version ^3.4.2-solc-0.7

[jeffywu]

OZ versions are used here (@4.5.0)
https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/brownie-config.yml#L7-L8

[gzeoneth]

#145

[gzeoneth]

Consider with #218