Missing init check may update operator earlier than desired

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/main/contracts/Aura.sol#L82

Vulnerability details

Impact

The updateOperator function should only be allowed to be called after init function otherwise operator would get updated from Aura.sol contract deployer before original operator could provide initial mint using init function

Proof of Concept

1. Aura.sol contract is deployed and operator is currently User X
2. User A simply calls updateOperator function which updates the operator to User Y
3. User X now loses his operator access and cannot call init function

Recommended Mitigation Steps

Add a check in updateOperator function to confirm this

function updateOperator() public {
		require(minter!=address(0), "Init should be called before using this function");
        address newOperator = IStaker(vecrvProxy).operator();
        emit OperatorChanged(operator, newOperator);
        operator = newOperator;
    }

[0xMaharishi]

severity 0 or 1. Dupo of #19

[0xMaharishi]

code-423n4/2022-05-aura#6

[dmvt]

I'm going to downgrade this one to a gas issue given that the worst impact is a required redeploy.

[dmvt]

Grouping this with the warden’s gas report, #129