<!-- canonical: https://0xsimao.com/findings/teller-finance-ownable-init-commitment-initialize -->

# Missing `__Ownable_init()` call in `LenderCommitmentGroup_Smart::initialize()`

Medium · Sherlock · Lending · 23rd April 2024

Finding M-2 of the Teller Finance competition.

- Protocol: https://audits.sherlock.xyz/contests/295
- Codebase: https://github.com/0xsimao/2024-04-teller-finance/tree/defe55469a2576735af67483acf31d623e13592d
- Source: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/35

---

## Summary

`__Ownable_init()` is not called in `LenderCommitmentGroup_Smart::initialize()`, which will make the contract not have any owner.

## Vulnerability Detail

`LenderCommitmentGroup_Smart::initialize()` does not call `__Ownable_init()` and will be left without owner.  

## Impact

Inability to [pause](https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L793) and [unpause](https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L800) borrowing in `LenderCommitmentGroup_Smart` due to having no owner, as these functions are `onlyOwner`.

## Code Snippet

https://github.com/sherlock-audit/2024-04-teller-finance/blob/main/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L158

## Tool used

Manual Review

Vscode

## Recommendation

Modify `LenderCommitmentGroup_Smart::initialize()` to call  `__Ownable_init()`:
```solidity
function initialize(
    ...
) external initializer returns (address poolSharesToken_) {
    __Ownable_init();
}
```

---

Related findings:

- [Missing documentation for MapleLoan, SetPendingLender and AcceptLender being implemented on MapleLoan but not on LoanManager.](https://0xsimao.com/findings/maple-finance-iii-documentation-pending-accept-implemented): Maple Finance
- [OstiumTrading::topUpCollateral() is missing pairsStored.groupMaxCollateral(pairIndex) check](https://0xsimao.com/findings/ostium-collateral-pairs-stored-index): Ostium
- [Missing `disableInitializers()` call in `StandardIDOPool::constructor()`](https://0xsimao.com/findings/blast-ido-pools-disable-initializers-standard-constructor): Blast IDO Pools
- [Missing disableInitializers() call in the constructor](https://0xsimao.com/findings/ostium-disable-initializers-call-constructor): Ostium