# Teller Bugfix Review and Bug Bounty Launch

Uninitialized beacon proxy in Teller could be initialized by anyone to point at a malicious beacon, selfdestructing the proxy and permanently locking >1M DAI.

- Payout: $50,000
- Severity: critical
- Program: Teller
- Credited: Bugdefeat
- Disclosed: 2021-08-04
- Write-up quality: 7/10
- Original: https://immunefi.com/blog/bug-fix-reviews/teller-bugfix-review-and-bug-bounty-launch/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-teller-bugfix-review-and-bug-bounty-launch
- Tags: domain:web3 impact:dos impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:misconfiguration

**Target:** InitializeableBeaconProxy upgradeable proxy contract (beacon pattern)
**Root cause:** The beacon proxy was deployed without initialization, leaving its beacon address at 0, so anyone could call initialize() to set an arbitrary beacon pointing to attacker-controlled implementation code.
**Steps:**
1. Deploy malicious implementation `Killer` whose `implementation()` returns itself and whose `kill()` selfdestructs.
2. Deploy malicious beacon pointing to `Killer`.
3. Call `ibp.initialize(address(killer), "")` on the uninitialized proxy at `0x08162332b1C13E6d1E80AC0D756aF255d218DC20`.
4. Call `ibp.kill()`; proxy delegatecalls into malicious implementation which selfdestructs the proxy.
**How found:** Whitehat noticed the beacon proxy's beacon address was still 0 (uninitialized), meaning initialize() was callable by anyone, and reasoned that a malicious beacon plus selfdestruct implementation could brick the proxy.
**Exploitation:** Attacker initializes the proxy to a malicious beacon, then triggers a delegatecall into a selfdestructing implementation, destroying the proxy and permanently locking the >1M DAI held by it; could also be used to ransom the protocol.
**Insight:** For beacon/UUPS proxies, check whether the implementation or beacon slot is still zero post-deployment; an uninitialized proxy lets anyone set the implementation and delegatecall into selfdestruct, bricking the contract and locking funds.