# Potential DOS in Contracts Inheriting UUPSUpgradeable.sol

Uninitialized UUPS implementation of NoteERC20 could be initialized by anyone, who then upgrades it to a self-destructing contract, bricking the proxy until redeployment.

- Payout: Audit contest
- Severity: high
- Program: Notional
- Found by: leastwood
- Disclosed: 2021-10-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-08-notional-findings/issues/98
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-09
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:dos

**Target:** UUPS proxy implementation contract (NoteERC20.sol)
**Root cause:** Deployment scripts left the UUPS implementation contract uninitialized, so anyone could call initialize() and become owner, bypassing the _authorizeUpgrade onlyOwner check.
**Steps:**
1. Deploy leaves NoteERC20 implementation uninitialized
2. Attacker calls `initialize()` on implementation contract to gain owner role
3. Attacker calls `UUPSUpgradeable.upgradeToAndCall()` pointing to attacker contract whose fallback self-destructs
4. Delegate call executes self-destruct, destroying implementation contract
5. All NoteERC20 proxy calls revert until new implementation deployed
**How found:** Researcher knew the OpenZeppelin advisory about initializing UUPS implementation contracts and checked Notional's deployment scripts, finding NoteERC20's implementation left uninitialized.
**Exploitation:** Attacker takes ownership of the uninitialized implementation, upgrades it to a malicious contract containing selfdestruct in its fallback, and the delegate call destroys the implementation, causing a permanent DOS on the NoteERC20 proxy.
**Insight:** For any UUPS/transparent proxy deployment, check whether the implementation contract itself was initialized (or has a disabled initializer); an uninitialized implementation lets anyone become owner and self-destruct it via upgradeToAndCall.