# Solady Ownable Init Frontrun

> Detect front-runnable ownership initialization in Solady Ownable / OwnableRoles. Solady's `_initializeOwner` is a guarded one-time setter (it reverts with `AlreadyInitialized` on a second call) but it is NOT access-controlled, so in constructor-less deployment paths (minimal-proxy clones, EIP-1167, factory `create`/`create2` without atomic init) an attacker can call the public initializer first a…

- **Type:** Skill
- **Install:** `agentstack add skill-omermaksutii-rugproof-solady-ownable-init-frontrun`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [omermaksutii](https://agentstack.voostack.com/s/omermaksutii)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [omermaksutii](https://github.com/omermaksutii)
- **Source:** https://github.com/omermaksutii/RugProof/tree/main/rules/solady-gotchas/skills/solady-ownable-init-frontrun
- **Website:** https://omermaksutii.github.io/RugProof

## Install

```sh
agentstack add skill-omermaksutii-rugproof-solady-ownable-init-frontrun
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Solady Ownable initializer front-run detection

## When this applies

Trigger on any of:

- `import {Ownable} from "solady/auth/Ownable.sol";` or `OwnableRoles`
- A contract calling `_initializeOwner(...)` from a public/external `initialize()` rather than the constructor
- Minimal-proxy clones (`LibClone.clone` / EIP-1167) of an Ownable implementation
- Factory deployments where `create`/`create2` and `initialize()` are two separate transactions
- Implementation contracts behind proxies (UUPS / transparent) using Solady Ownable
- Any `initialize`/`init` that is not protected by an initializer guard or atomic deploy

## Detection patterns

### Public init, non-atomic deploy (HIGH)
```solidity
contract Vault is Ownable {
    function initialize(address owner) external {
        _initializeOwner(owner);   // reverts on 2nd call — but ANYONE can make the 1st
    }
}
// Factory:
address v = LibClone.clone(impl);
Vault(v).initialize(msg.sender);   // ← separate tx: front-runnable in the mempool
```
Between `clone` and `initialize`, a searcher front-runs `initialize(attacker)`. `_initializeOwner` succeeds for them; the legit call then reverts `AlreadyInitialized`.
**Signal:** `_initializeOwner` reachable from an unguarded external function and deploy/init are not in one transaction.

### Implementation left uninitialized (HIGH)
```solidity
contract Impl is Ownable {
    function initialize(address o) external { _initializeOwner(o); }
}
// Impl deployed standalone, never initialized → anyone claims it.
```
For UUPS, an attacker who owns the *implementation* can call `upgradeTo`/`selfdestruct`-style logic and brick or hijack all proxies pointing at it.
**Signal:** Solady Ownable implementation deployed but not initialized in the same tx, and the implementation itself is callable.

### Re-init via `_setOwner` exposure (MEDIUM-HIGH)
```solidity
function _setOwner(address o) internal { ... }   // Solady internal
function rescueOwner(address o) external { _setOwner(o); }  // ← bypasses init guard entirely
```
`_setOwner` has no `AlreadyInitialized` guard; exposing it publicly defeats the one-time protection.
**Signal:** `_setOwner` wrapped in an unprotected external function.

## Severity rubric

| Pattern | Severity | Notes |
|---|---|---|
| Clone/factory with non-atomic public initialize | **High** | Ownership theft, mempool front-run |
| Uninitialized implementation behind proxy | **High** | Impl hijack → proxy compromise |
| `_setOwner` exposed externally | **High** | Init guard bypassed entirely |
| Init gated to factory `msg.sender` / atomic deploy | **Info** | Correctly protected |

## Remediation patterns

1. **Atomic deploy+init** — initialize inside the same transaction as `clone`/`create`, or use `LibClone.cloneDeterministic` + immediate init in the factory call.
2. **Restrict the initializer** — `require(msg.sender == factory)` or pass owner via clone immutable args (`LibClone.clone(impl, immutableArgs)`).
3. **Lock the implementation** — call `_initializeOwner(deadAddress)` / `_disableInitializers`-equivalent in the implementation's constructor so the standalone impl can't be claimed.
4. **Never expose `_setOwner`** — only `transferOwnership` (owner-gated) and the guarded `_initializeOwner`.

## False-positive notes

- Constructor-based `_initializeOwner` (non-clone deploy) is not front-runnable — Info.
- Factory that deploys and initializes in one call (atomic) — not exploitable.
- Initializer gated on `msg.sender == factory` or consuming clone immutable args — safe.

## Related

- [[access-control]]
- [[delegatecall-risks]] — UUPS implementation hijack
- [[centralization-risk]]

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [omermaksutii](https://github.com/omermaksutii)
- **Source:** [omermaksutii/RugProof](https://github.com/omermaksutii/RugProof)
- **License:** MIT
- **Homepage:** https://omermaksutii.github.io/RugProof

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-omermaksutii-rugproof-solady-ownable-init-frontrun
- Seller: https://agentstack.voostack.com/s/omermaksutii
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.