stake.link

Summary

Typically, the account that deploys the contract is also its owner. Consequently, the owner is able to engage in certain privileged activities in his own name.

Vulnerability Details

In smart contracts, the renounceOwnership() function is used to renounce ownership, which means that if the con- tract's ownership has never been transferred, it will never have an Owner.

Impact

This renders some owner-exclusive functionality unavailable.

Tools Used

Manual Review
VS code

Recommendations

I recommend that to prevent the owner from calling renounce Ownership without first transferring ownership to a different address. Additionally, if you decide to use a multi- signature wallet, then the execution of the renounce Ownership will require for at least two or more users to be confirmed. Alternatively, you can disable Renounce Ownership functionality by overriding it.