# createMarket and createBorrowATokenV1_5 always fail due to owner() being set to address(0)after v1.7 upgrade

SizeFactory v1.7 upgrade renounces ownership to address(0), so createMarket and createBorrowATokenV1_5 always revert, permanently blocking new market and borrow-token creation.

- Payout: Contest reward
- Severity: medium
- Program: Size
- Credited: pep7siup
- Disclosed: 2025-04-03
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_size_february2025.pdf#3.1.2
- Library page: https://bugbountylibrary.com/r/cantina%3Asize_february2025%3A3.1.2
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:access-control vuln:misconfiguration

**Target:** SizeFactory smart contract (createMarket, createBorrowATokenV1_5)
**Root cause:** The v1.7 upgrade calls transferOwnership(address(0)), setting owner() to zero; both factory functions pass owner() into initializers that reject the null address (validateOwner / OwnableInvalidOwner).
**Steps:**
1. Deploy/upgrade SizeFactory to v1.7 which renounces ownership: `owner() == address(0)`
2. Call `sizeFactory.createMarket(f, r, o, d)` as any caller
3. Observe revert `NULL_ADDRESS()` from Size.initialize -> validateOwner
4. Call `sizeFactory.createBorrowATokenV1_5(variablePool, usdc)`
5. Observe revert `OwnableInvalidOwner(address(0))` from NonTransferrableScaledTokenV1_5 initializer
**How found:** Noticed the v1.7 reinitialize script renounces ownership, then traced that createMarket and createBorrowATokenV1_5 feed owner() into initializers that validate against address(0); confirmed with a fork test asserting owner()==0 and expecting both reverts.
**Insight:** When auditing upgrade/reinitialize scripts, check every state variable the migration zeroes or renames (owner, admin, roles) against downstream functions that read it implicitly; a renounced owner silently bricks factory functions that pass owner() into initializers.