Summary

The same issue is reported by TrailOfBits as a High Severity Bug here:

https://docs.looksrare.org/blog/looksrare-security-audit-by-trail-of-bits#2-lack-of-two-step-process-for-contract-ownership-changes-high

Ownable lets you:

1. transferOwnership from the owner's account to a new one.

2. renounceOwnership for the owner to relinquish this administrative privilege, a typical pattern after an initial stage with centralized administration is over.

If the wrong address is written while transferring the ownership, the whole protocol will be destroyed.

Vulnerability Details

Ownable2Step and Ownable2StepUpgradeable prevent the contract ownership from mistakenly being transferred to an address that cannot handle it (e.g. due to a typo in the address), by requiring that the recipient of the owner permissions actively accept via a contract call of its own.

Impact

Bob, a Composable Finance developer, invokes transferOwnership() to change the
address of an existing contract’s owner but accidentally enters the wrong address. As a
result, he permanently loses access to the contract.

Tools Used

Manual Review

Recommendations

Consider using Ownable2Step instead of Ownable