Use 2 step ownership instead of single step ownership
Summary
The ownership pattern implementation is linked to the Ownable contract where a single-step transfer is implemented.
This can lead to problem for all methods marked in onlyOwner throughout the codebase, in which some of have core protocol functionality.
Vulnerability Details
RewardsInitiator, SDLPoolCCIPController, RESDLTokenBridge, WrappedTokenBridge and LinearBoostController contract utilizes Ownable contract which is prone to error due to lack effective control.
Impact
Single-step transfer of ownership means, if a wrong address is passed during transferring of ownership it will result in loss of owner based role forever.
Tools Used
Manual Code Review
Recommendations
It is a best practice to use two-step ownership transfer pattern where ownership transfer gets to a "pending" state and the new owner should claim his new rights, otherwise the old owner will still has control of the contract.
Consider using OpenZeppelin's Ownable2Step contract.
Lead Judging Commences
ownable-2step
have a 2-step owner transfer
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.