Use 2 step ownership transfer instead of single
Summary
The ownership pattern implementation is linked to the Ownable contract where a single-step transfer is implemented.
This can lead to problem for all methods marked in onlyOwner throughout the codebase, in which some of have core protocol functionality.
Vulnerability Details
SmartVaultManagerV5 and LiquidationPoolManager contract utilizes Ownable and OwnableUpgradeable contract which is prone to error due to lack effective control.
Impact
Single-step transfer of ownership means, if a wrong address is passed during transferring of ownership it will result in loss of owner based role forever.
Tools Used
Manual Code Review
Recommendations
It is a best practice to use two-step ownership transfer pattern where ownership transfer gets to a "pending" state and the new owner should claim his new rights, otherwise the old owner will still has control of the contract.
Consider using OpenZeppelin's Ownable2Step contract.
Lead Judging Commences
single-step-ownership
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.