Submission Details
Severity:
Centralization risk for privileged functions
Summary
The owner is a single point of failure and a centralization risk
There are 2 instances of this issue
Vulnerability Details
Having a single EOA as the only owner of contracts is a large centralization risk and a single point of failure. A single private key may be taken in a hack, or the sole holder of the key may become unable to retrieve the key when necessary.
https://cwe.mitre.org/data/definitions/654.html
Impact
File: src/protocol/ThunderLoan.sol
253: function updateFlashLoanFee(uint256 newFee) external onlyOwner {
File: src/upgradedProtocol/ThunderLoanUpgraded.sol
251: function updateFlashLoanFee(uint256 newFee) external onlyOwner {
Tools Used
Manual review-
Recommendations
Consider changing to a multi-signature setup, or having a role-based authorization model.
Rewards breakdown
nSLOC
387This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.