Beedle - Oracle free perpetual lending

Summary

Ownable.sol contract uses a single-step process for ownership transfer, which is unsafe.

Vulnerability Details

The current ownership transfer process involves the current owner calling transferOwnership(). This function write the new owner's address into the owner's state variable.

Impact

If the nominated EOA account is not a valid account, it is entirely possible the owner may accidentally transfer ownership to an uncontrolled account, breaking all functions with the onlyOwner() modifier.

Tools Used

Manual Review.

Recommendations

Implement zero address check and Consider implementing a two step process where the owner nominates an account and the nominated account needs to call an acceptOwnership() function for the transfer of ownership to fully succeed. This ensures the nominated EOA account is a valid and active account.