Beedle - Oracle free perpetual lending

Vulnerability Details

The use of onlyOwner() modifier as public make this modifer call by any external attacker account due to this any malicious attacker can be the owner of the protocol. i.e: if you are calling the constructor from an external account, you are providing the initial owner address. The contract, as it is written, allows anyone to deploy the contract and specify the initial owner. This means that the first person who deploys the contract and specifies an address as the _owner will become the owner of the contract.
##Proof

modifier onlyOwner() virtual {
require(msg.sender == owner, "UNAUTHORIZED");
_;
}

Impact

Any malicious attacker can be the owner and affect the whole contract functions.

Tools Used

Manual check.

Recommendations

Change the visibility of this modifier as internal.