Submission Details
Severity:
Smart Vault Owner's Potential Loss of Access
Summary
Vulnerability Details
The current implementation of SmartVault3#setOwner allows the vaultManager to change the new owner of the vault at any time, even if the vault owners have paid back their debt, and their vault remains healthy. Although it was mentioned that the admin is trusted, it's advisable to impose certain limitations.
Impact
Vault owners can loose access to their vaults at any moment.
Tools Used
Manual
Recommendations
Consider adding a function to setOwner that allows only the vaultManager to change the owner only when the vault is liquidated or undercollateralized.
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.