Submission Details
Severity:
Contract lacks onlyOwner check causing anyone to call the selectWinner and withdrawFess function
Summary
The contract lacks onlyOwner checks on the selectWinner and withdrawFees functions.
Vulnerability Details
Though the docs don't mention that these functions should have onlyOwner checks but if thought logically the selectWinner and withdrawFees function should only be accessible to the owner of the contarct instead of anyone to have an access over these functions.
Impact
Anyone can access the selectWinner and withdrawFees functions.
Tools Used
VS Code
Recommendations
Add onlyOwner modifier to selectWinner and withdrawFees functions.
function selectWinner() external onlyOwner{
...
}
function withdrawFees() external onlyOwner{
...
}
Updates
Lead Judging Commences
Hamiltonite about 2 years ago
Submission Judgement Published Reason: User experience and design improvement
Rewards breakdown
nSLOC
143This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.