Protocol Relies Heavily On Admin, Single Step Ownership Can Be Dangerous
Summary
All contracts inheriting from OpenZeppelin's Ownable are at risk of the owner accidentally transfering ownership to a wrong address or the zero address. This risk arises from the potential misuse of the renounceOwnership or transferOwnership functions.
Impact
The affected contracts inheriting Ownable will be left without owner and all the criticial functionalities that is performed by only owner will be useless.
Tools Used
Manual
Recommendations
The better way to do this is to use a two-step ownership transfer approach, where the new owner should first claim its new rights before they are transferred.
Mitigation : Use OpenZeppelin's Ownable2Step instead of Ownable
Lead Judging Commences
ownable-2step
have a 2-step owner transfer
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.