Unimplemented Authorization in staking
Summary
Protocol seems to use Ownable functionality but it has not been implemented in the code.
Vulnerability Details
Inside Staking.sol, the Staking contract is marked as Ownable which is intended to use some authorization functionality. But in the current implementation, the owner (or onlyOwner ) modifier is not enforced on the functions that the protocol considers sensitive. I think there is some missing implementation here.
Impact
The protocol staking feature will not work as it was intended at the start.
Tools Used
Manual review
Recommendations
Try to clearly define how which functions can be only called by the owner and enforce the onlyOwner modifier on them
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.