Sparkn

Summary

As protocol is heavily dependent on admin actions, single-step ownership transfer is extremely dangerous.

Vulnerability Details

The protocol's ownership transfer operates as a one-step process, which implies that if an incorrect address is provided during the ownership or admin rights transfer, it could result in the permanent loss of that role. The protocol's ownership pattern is established in the Ownable.sol contract, where this single-step transfer mechanism is implemented. This characteristic could potentially pose an issue for all methods within the protocol that use the onlyOwner modifier, as many of these methods constitute essential components of the core protocol functionality.

Impact

Loss of owner privileges.

Tools Used

Manual review

Recommendations

Utilizing a two-step ownership transfer pattern is recommended. In this approach, the ownership transfer enters a "pending" state, requiring the new owner to actively claim their new rights, meanwhile the old owner still has control of the contract. Consider using OpenZeppelin's Ownable2Step contract.