# VaultProxy implementation can be initialized by anyone and self-destructed

Uninitialized VaultProxy implementation could be initialized by anyone, then self-destructed via delegatecall, bricking all cloned vaults.

- Payout: Contest reward
- Severity: high
- Program: Stader Labs
- Credited: broccolirob
- Disclosed: 2023-07-19
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-06-stader-findings/issues/418
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-stader%3AH-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:misconfiguration

**Target:** VaultProxy implementation contract / VaultFactory clones
**Root cause:** VaultProxy implementation contract's initialise() was never called at factory deployment, leaving it callable by anyone to set arbitrary _staderConfig; fallback delegatecalls into that address.
**Steps:**
1. Deploy `AttackContract` whose fallback calls `selfdestruct(address(0))` and whose `getNodeELRewardVaultImplementation()`/`getValidatorWithdrawalVaultImplementation()` return its own address
2. Call `initialise(...)` on the VaultProxy implementation address (stored in `vaultProxyImplementation` on VaultFactory), passing `AttackContract` as `_staderConfig`
3. Call any non-existent function on the VaultProxy implementation to trigger its `fallback`
4. Fallback calls `staderConfig.getNodeELRewardVaultImplementation()` -> returns AttackContract, then `delegatecall` executes AttackContract's fallback in VaultProxy context, running `selfdestruct` and erasing implementation code
5. All clones now delegate to an address with no code; calls return `true` without executing
**How found:** Code reading: noticed VaultFactory never calls initialise on the newly created VaultProxy implementation, leaving the initializer exposed; reasoned that the fallback's delegatecall target is attacker-controlled via _staderConfig, enabling selfdestruct of the implementation.
**Exploitation:** Attacker initializes the unprotected implementation with a malicious staderConfig, triggers fallback to delegatecall a self-destructing contract, wiping the implementation so every cloned vault's delegatecalls silently succeed as no-ops, locking funds.
**Insight:** For clone/proxy factories, check whether the implementation contract itself is initialized or initializer-locked; an exposed initializer on the implementation lets an attacker control the delegatecall target and selfdestruct it, bricking all clones.