Sparkn

Summary

The ProxyFactory contract inherits from OpenZeppelin's Ownable contract. Therefore, it is using a single-step ownership transfer pattern. If the admin accidentally transfers the ownership of the contract to an address which they do not control, the protocol will face severe consequences. Two-step ownership transfer pattern is suggested as a much safer approach.

Vulnerability Details

If the admin loses the owner role, the following consequences will occur:

1. Creation of new contests will not be possible;

2. The funds from the expired contests will be locked forever;

3. The new owner will have the opportunity to steal all the funds from expired contests.

Impact

Impact is High, as the protocol relies heavily on the trusted owner. If admin loses the owner role, it would render the new contest creation impossible and put the funds directly at risk.

Likelihood is Low, as the scenario requires an admin error.

Severity is therefore estimated as Medium.

Tools Used

Manual Review, Solodit

Recommendations

Use OpenZeppelin's Ownable2Step in place of Ownable.