Submission Details
Severity:
Lack of a method to change `stadiumAddress`
Summary
In case the owner's stadiumAddress ever gets stolen or simply the owner loses access to it, there is no way to change it in the implementation contract, which means it will have to be redeployed.
Vulnerability Details
There is no way of changing the stadiumAddress after it is set in the constructor because the variable is declared as immutable and there's no function to change it.
Impact
Owner will have to bear the redeployment cost in case something happens with the stadiumAddress.
Tools Used
Manual review
Recommendations
in Distributor.sol
++import {Ownable} from "openzeppelin/access/Ownable.sol";
--contract Distributor {
++contract Distributor is Ownable {
...
--address private immutable STADIUM_ADDRESS;
++address private STADIUM_ADDRESS; //need to ensure there are no storage colissions
...
++ function changeStadiumAddress(address newStadiumAddress) external onlyOwner {
++ STADIUM_ADDRESS = newStadiumAddress;
++ }
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.