[OZ][N-10] _disableInitializers() Not Being Called From Initializable Contract Constructors

contracts/interfaces/ISFC.sol

@@ -15,7 +15,13 @@ interface ISFC {
     );
     event Delegated(address indexed delegator, uint256 indexed toValidatorID, uint256 amount);
     event Undelegated(address indexed delegator, uint256 indexed toValidatorID, uint256 indexed wrID, uint256 amount);
-    event Withdrawn(address indexed delegator, uint256 indexed toValidatorID, uint256 indexed wrID, uint256 amount);
+    event Withdrawn(
+        address indexed delegator,
+        uint256 indexed toValidatorID,
+        uint256 indexed wrID,
+        uint256 amount,
+        uint256 penalty
+    );
     event ClaimedRewards(address indexed delegator, uint256 indexed toValidatorID, uint256 rewards);
     event RestakedRewards(address indexed delegator, uint256 indexed toValidatorID, uint256 rewards);
     event BurntFTM(uint256 amount);

contracts/sfc/ConstantsManager.sol

@@ -1,13 +1,13 @@
 // SPDX-License-Identifier: UNLICENSED
 pragma solidity 0.8.27;
 
-import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";
 import {Decimal} from "../common/Decimal.sol";
 
 /**
  * @custom:security-contact [email protected]
  */
-contract ConstantsManager is OwnableUpgradeable {
+contract ConstantsManager is Ownable {
     // Minimum amount of stake for a validator, i.e., 500000 FTM
     uint256 public minSelfStake;
     // Maximum ratio of delegations a validator can have, say, 15 times of self-stake
@@ -37,6 +37,10 @@ contract ConstantsManager is OwnableUpgradeable {
     // Zero to disable validators deactivation by this metric.
     uint64 public minAverageUptime;
 
+    // The address of the recipient that receives issued tokens
+    // as a counterparty to the burnt FTM tokens
+    address public issuedTokensRecipient;
+
     /**
      * @dev Given value is too small
      */
@@ -47,9 +51,7 @@ contract ConstantsManager is OwnableUpgradeable {
      */
     error ValueTooLarge();
 
-    constructor(address owner) initializer {
-        __Ownable_init(owner);
-    }
+    constructor(address owner) Ownable(owner) {}
 
     function updateMinSelfStake(uint256 v) external virtual onlyOwner {
         if (v < 100000 * 1e18) {
@@ -179,4 +181,8 @@ contract ConstantsManager is OwnableUpgradeable {
         }
         minAverageUptime = v;
     }
+
+    function updateIssuedTokensRecipient(address v) external virtual onlyOwner {
+        issuedTokensRecipient = v;
+    }
 }

contracts/sfc/NodeDriver.sol

@@ -35,6 +35,11 @@ contract NodeDriver is OwnableUpgradeable, UUPSUpgradeable, INodeDriver {
     event UpdateNetworkVersion(uint256 version);
     event AdvanceEpochs(uint256 num);
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /// Initialization is called only once, after the contract deployment.
     /// Because the contract code is written directly into genesis, constructor cannot be used.
     function initialize(address _backend, address _evmWriterAddress, address _owner) external initializer {
@@ -144,4 +149,6 @@ contract NodeDriver is OwnableUpgradeable, UUPSUpgradeable, INodeDriver {
     function sealEpochValidators(uint256[] calldata nextValidatorIDs) external onlyNode {
         backend.sealEpochValidators(nextValidatorIDs);
     }
+
+    uint256[50] private __gap;
 }

contracts/sfc/NodeDriverAuth.sol

@@ -21,6 +21,11 @@ contract NodeDriverAuth is OwnableUpgradeable, UUPSUpgradeable {
     error DriverCodeHashMismatch();
     error RecipientNotSFC();
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     // Initialize NodeDriverAuth, NodeDriver and SFC in one call to allow fewer genesis transactions
     function initialize(address payable _sfc, address _driver, address _owner) external initializer {
         __Ownable_init(_owner);
@@ -83,9 +88,6 @@ contract NodeDriverAuth is OwnableUpgradeable, UUPSUpgradeable {
 
     /// Mint native token. To be used by SFC for minting validators rewards.
     function incBalance(address acc, uint256 diff) external onlySFC {
-        if (acc != address(sfc)) {
-            revert RecipientNotSFC();
-        }
         driver.setBalance(acc, address(acc).balance + diff);
     }
 
@@ -186,4 +188,6 @@ contract NodeDriverAuth is OwnableUpgradeable, UUPSUpgradeable {
         }
         return codeHash;
     }
+
+    uint256[50] private __gap;
 }

contracts/sfc/SFC.sol

@@ -50,6 +50,9 @@ contract SFC is OwnableUpgradeable, UUPSUpgradeable, Version {
     // total stake of active (OK_STATUS) validators (total weight)
     uint256 public totalActiveStake;
 
+    // unresolved fees that failed to be send to the treasury
+    uint256 public unresolvedTreasuryFees;
+
     // delegator => validator ID => stashed rewards (to be claimed/restaked)
     mapping(address delegator => mapping(uint256 validatorID => uint256 stashedRewards)) internal _rewardsStash;
 
@@ -190,6 +193,10 @@ contract SFC is OwnableUpgradeable, UUPSUpgradeable, Version {
     error ValidatorNotSlashed();
     error RefundRatioTooHigh();
 
+    // treasury
+    error TreasuryNotSet();
+    error NoUnresolvedTreasuryFees();
+
     event DeactivatedValidator(uint256 indexed validatorID, uint256 deactivatedEpoch, uint256 deactivatedTime);
     event ChangedValidatorStatus(uint256 indexed validatorID, uint256 status);
     event CreatedValidator(
@@ -200,13 +207,20 @@ contract SFC is OwnableUpgradeable, UUPSUpgradeable, Version {
     );
     event Delegated(address indexed delegator, uint256 indexed toValidatorID, uint256 amount);
     event Undelegated(address indexed delegator, uint256 indexed toValidatorID, uint256 indexed wrID, uint256 amount);
-    event Withdrawn(address indexed delegator, uint256 indexed toValidatorID, uint256 indexed wrID, uint256 amount);
+    event Withdrawn(
+        address indexed delegator,
+        uint256 indexed toValidatorID,
+        uint256 indexed wrID,
+        uint256 amount,
+        uint256 penalty
+    );
     event ClaimedRewards(address indexed delegator, uint256 indexed toValidatorID, uint256 rewards);
     event RestakedRewards(address indexed delegator, uint256 indexed toValidatorID, uint256 rewards);
     event BurntFTM(uint256 amount);
     event UpdatedSlashingRefundRatio(uint256 indexed validatorID, uint256 refundRatio);
     event RefundedSlashedLegacyDelegation(address indexed delegator, uint256 indexed validatorID, uint256 amount);
     event AnnouncedRedirection(address indexed from, address indexed to);
+    event TreasuryFeesResolved(uint256 amount);
 
     modifier onlyDriver() {
         if (!isNode(msg.sender)) {
@@ -215,6 +229,11 @@ contract SFC is OwnableUpgradeable, UUPSUpgradeable, Version {
         _;
     }
 
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /// Initialization is called only once, after the contract deployment.
     /// Because the contract code is written directly into genesis, constructor cannot be used.
     function initialize(
@@ -419,11 +438,41 @@ contract SFC is OwnableUpgradeable, UUPSUpgradeable, Version {
         }
     }
 
+    /// Resolve failed treasury transfers and send the unresolved fees to the treasury address.
+    function resolveTreasuryFees() external {
+        if (treasuryAddress == address(0)) {
+            revert TreasuryNotSet();
+        }
+        if (unresolvedTreasuryFees == 0) {
+            revert NoUnresolvedTreasuryFees();
+        }
+
+        // zero the fees before sending to prevent re-entrancy
+        uint256 fees = unresolvedTreasuryFees;
+        unresolvedTreasuryFees = 0;
+
+        (bool success, ) = treasuryAddress.call{value: fees, gas: 1000000}("");
+        if (!success) {
+            revert TransferFailed();
+        }
+
+        emit TreasuryFeesResolved(fees);
+    }
+
     /// burnFTM allows SFC to burn an arbitrary amount of FTM tokens.
     function burnFTM(uint256 amount) external onlyOwner {
         _burnFTM(amount);
     }
 
+    /// Issue tokens to the issued tokens recipient as a counterparty to the burnt FTM tokens.
+    function issueTokens(uint256 amount) external onlyOwner {
+        if (c.issuedTokensRecipient() == address(0)) {
+            revert ZeroAddress();
+        }
+        node.incBalance(c.issuedTokensRecipient(), amount);
+        totalSupply += amount;
+    }
+
     /// Update treasury address.
     function updateTreasuryAddress(address v) external onlyOwner {
         treasuryAddress = v;
@@ -706,7 +755,7 @@ contract SFC is OwnableUpgradeable, UUPSUpgradeable, Version {
         }
         _burnFTM(penalty);
 
-        emit Withdrawn(delegator, toValidatorID, wrID, amount);
+        emit Withdrawn(delegator, toValidatorID, wrID, amount - penalty, penalty);
     }
 
     /// Get highest epoch for which can be claimed rewards for the given validator.
@@ -909,6 +958,9 @@ contract SFC is OwnableUpgradeable, UUPSUpgradeable, Version {
             if (!success) {
                 // ignore treasury transfer failure
                 // the treasury failure must not endanger the epoch sealing
+
+                // store the unresolved treasury fees to be resolved later
+                unresolvedTreasuryFees += feeShare;
             }
         }
     }
@@ -1117,4 +1169,6 @@ contract SFC is OwnableUpgradeable, UUPSUpgradeable, Version {
     function _now() internal view virtual returns (uint256) {
         return block.timestamp;
     }
+
+    uint256[50] private __gap;
 }

contracts/test/FailingReceiver.sol

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity 0.8.27;
+
+contract FailingReceiver {
+    // Fallback function to reject any received Ether
+    receive() external payable {
+        revert("Forced transfer failure");
+    }
+}

package.json

@@ -45,6 +45,7 @@
     "typescript-eslint": "^8.8.0"
   },
   "dependencies": {
+    "@openzeppelin/contracts": "^5.1.0",
     "@openzeppelin/contracts-upgradeable": "^5.1.0",
     "dotenv": "^16.0.3"
   }