Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium

Implementing `renounceOwnership` is dangerous

madalad

Summary

Accidentally calling renounceOwnerhip breaks the protocol.

Vulnerability Details

ProxyFactory inherits Ownable and relies on the owner to initiate contests by calling setContest, a key feature of the protocol. Ownable implements renounceOwnership by default, meaning the owner can call it to transfer ownership to the zero address. This is dangerous because, if done by mistake, it would make the entire protocol entirely unusable.

File: lib\openzeppelin-contracts\contracts\access\Ownable.sol
​
61: function renounceOwnership() public virtual onlyOwner {
62: _transferOwnership(address(0));
63: }

Impact

ProxyFactory contract could be left ownerless, making it impossible to create new contests.

Tools Used

Manual review

Recommendations

Override the renounceOwnership function to make it impossible to renounce ownership:

contract ProxyFactory is Ownable, EIP712 {
​
// contract code
​
+ function renounceOwnership() public override onlyOwner {
+ revert();
+ }
​
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!