# Unable to call some functions in the incentive contracts with onlyOwner modifier because of incorrect initialization leading to stuck funds

BoostCore initializes incentive contracts so BoostCore becomes owner, making onlyOwner functions like drawRaffle and clawback uncallable, stranding funds.

- Payout: Contest reward
- Severity: high
- Program: Boost Aa Wallet
- Credited: 0xDemon
- Disclosed: 2024-06-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-boost-aa-wallet-judging/issues/43
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-boost-aa-wallet%3AH-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** ERC20Incentive / CGDAIncentive / ERC20VariableIncentive / ERC1155Incentive contracts
**Root cause:** Incentive initializer sets owner = msg.sender, and _makeIncentives calls it from BoostCore, so BoostCore becomes owner instead of the boost creator.
**Steps:**
1. Call `createBoost` with an out-of-the-box incentive (ERC20Incentive, CGDAIncentive, ERC20VariableIncentive, ERC1155Incentive).
2. `_makeIncentives` calls the incentive `initializer`, setting owner to `BoostCore`.
3. Attempt to call `drawRaffle` or `clawback` (onlyOwner) — only BoostCore can call, but it has no path to do so.
4. Raffle cannot be drawn and stuck funds cannot be clawed back.
**How found:** Code reading of createBoost/_makeIncentives initialization flow, noticing owner is set to msg.sender (BoostCore) rather than the boost creator, then checking onlyOwner functions like drawRaffle and clawback have no caller path.
**Insight:** When a factory initializes child contracts, check who msg.sender is inside the initializer — factory-as-owner silently bricks onlyOwner admin functions like raffle draws and fund clawback.