Submission Details
Severity:
function selectWinner() and withdrawFees() don't have onlyOwner modifier - Access control vulnerability
Summary
The selectWinner() function should have onlyOnwer modifier
Vulnerability Details
Only owner should be able to select a winner otherwise it seems illogical and also opens the door to the randomness vulnerability
Impact
Anyone can call the selectWinner() function, which is not what you'd like to happen
Tools Used
hardhat
Recommendations
-function selectWinner() external {
+function selectWinner() external onlyOwner{
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Reason: User experience and design improvement
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.