First Flight #2: Puppy Raffle

Summary

OpenZeppelin contracts have a renounce ownership function

Vulnerability Details

renounceOwnership can be called by error or by malicious owner leading to loss of ownership and controls over critical functionality in the contracts

Impact

Can lead to loss of ownership. Implies address for fees cant be changed e.g keys for that address lost or fee address under control malicious entitty; Implies fees cant be withdraw from protocol(assuming access control lacking fixed) so the ETH for fees will be stuck in the protocol forever

Tools Used

Manual Analysis

Recommendations

Override renounceOwnership function and ensure that it reverts