Implementation changes for proxy contracts that use MetadataRenderer and Token implementation contracts are not required to go through deployed DAO's proposal and voting process and are not enforced by a timelock
Audit: 2022-09-nouns-builder-findings
Severity: MEDIUM

# Lines of code

https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/lib/proxy/UUPS.sol#L47-L50
https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/lib/proxy/UUPS.sol#L55-L58
https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/token/metadata/MetadataRenderer.sol#L376-L378
https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/token/Token.sol#L305-L311
https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/token/metadata/MetadataRenderer.sol#L91-L163
https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/auction/Auction.sol#L244-L260


# Vulnerability details

## Impact
When calling the following `upgradeTo` and `upgradeToAndCall` functions in the proxy contracts that use the `MetadataRenderer` and `Token` implementation contracts, the `MetadataRenderer._authorizeUpgrade` and `Token._authorizeUpgrade` functions below are further called.

https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/lib/proxy/UUPS.sol#L47-L50
```solidity
    function upgradeTo(address _newImpl) external onlyProxy {
        _authorizeUpgrade(_newImpl);
        _upgradeToAndCallUUPS(_newImpl, "", false);
    }
```

https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/lib/proxy/UUPS.sol#L55-L58
```solidity
    function upgradeToAndCall(address _newImpl, bytes memory _data) external payable onlyProxy {
        _authorizeUpgrade(_newImpl);
        _upgradeToAndCallUUPS(_newImpl, _data, true);
    }
```

https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/token/metadata/MetadataRenderer.sol#L376-L378
```solidity
    function _authorizeUpgrade(address _impl) internal view override onlyOwner {
        if (!manager.isRegisteredUpgrade(_getImplementation(), _impl)) revert INVALID_UPGRADE(_impl);
    }
```

https://github.com/code-423n4/2022-09-nouns-builder/blob/main/src/token/Token.sol#L305-L311
```solidity
    function _authorizeUpgrade(address _newImpl) internal view override {
        // Ensure the caller is the shared owner of the token and metadata renderer
        if (msg.sender != owner()) revert ONLY_OWNER();

        // Ensure the implementation is valid
        if (!manager.isRegisteredUpgrade(_getImplementation(), _newImpl)) revert INVALID_UPGRADE(_newImpl);
    }
```

The [documentation](https://github.com/code-423n4/2022-09-nouns-builder/blob/main/docs/protocol-docs.md#deploy) states that "the protocol does not enforce artwork to be added" so the following `addProperties` function is not required to be called. When `addProperties` is not called, `transferOwnership(settings.treasury)` is not executed so the first configured founder remains as the `_owner` for the proxy contract that uses `MetadataRenderer`. Because the proxy contract that uses `Token` considers the `_owner` for the proxy contract that uses `MetadataRenderer` as its own `owner()`, then the `owner()` for that proxy contract is also the first configured founder.

https://github.com/code-423n4/2