# Usage of an incorrect version of Ownbale library can potentially malfunction all onlyOwner functions

DelegatedStaking used non-upgradeable Ownable in a proxy contract, leaving no owner and bricking all onlyOwner functions.

- Payout: Audit contest
- Severity: high
- Program: Covalent
- Found by: WatchPug
- Disclosed: 2021-11-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-covalent-findings/issues/45
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-covalent%3AH-01
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:misconfiguration

**Target:** DelegatedStaking.sol upgradeable proxy contract
**Root cause:** Contract is deployed behind an upgradeable proxy but imports @openzeppelin/contracts/access/Ownable.sol, whose constructor sets owner; constructors don't run in proxy context, so owner is never set.
**Steps:**
1. Deploy DelegatedStaking behind an upgradeable proxy
2. Call initialize(minStakedRequired) — it does not call __Ownable_init()
3. Observe owner() returns address(0)
4. Any onlyOwner function reverts for all callers
**How found:** Code reading: noticed initialize()/initializer pattern and 'used to have the contract upgradeable' comment, then checked the Ownable import path and found the non-upgradeable variant.
**Insight:** When auditing upgradeable proxies, grep every OpenZeppelin import for the contracts-upgradeable path and confirm each initializer calls the corresponding __X_init(); a non-upgradeable Ownable silently leaves owner unset.