First Flight #2: Puppy Raffle

Vulnerability Details :

Use of ownable for transferring the ownership.

POC

import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";

Impact

Openzeppelin ownable implementation has a shortcoming that it allows the owner to transfer ownership to a non-existent or mistyped address.

Tools Used

Manual check.

Recommendations

Ownable2Step is safer than Ownable for smart contracts because the owner cannot accidentally transfer smart contract ownership to a mistyped address. Rather than directly transferring to the new owner, the transfer only completes when the new owner accepts ownership.