Beedle - Oracle free perpetual lending

Summary

Critical Address Changes Should Use Two-step Procedure instead of direct transfer

Vulnerability Details

https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/utils/Ownable.sol#L19-L21

Impact

If you transfer the rights to the wrong account, you are most likely losing the ownership forever.

Tools Used

Manual Review

Recommendations

instead of having a transferOwnership that does the transfer in a single step, we would have a two step process, adding a confirmOwnershipTransfer function.So, when you do a transferOwnership you won’t be transferring it but just queuing the transfer.
Then the new owner candidate needs to explicitly call confirmOwnershipTransfer, which will revert in case of not being called by him, in order to accept receiving the ownership rights