The Standard

Summary

The setOwner function allows external calls to change the owner without adequate access control checks. Although there is an onlyVaultManager modifier, its enforcement is incomplete, creating a vulnerability.

Vulnerability Details

Impact

This vulnerability allows unauthorized users to alter the owner of the SmartVault contract, potentially leading to unauthorized control and manipulation of the contract's functionality.

Tools Used

Manual Code Review

Recommendations

Implement a secure mechanism to update the owner address. One possible approach is to create a separate function with appropriate access control checks. Alternatively, consider utilizing access control libraries like OpenZeppelin's Ownable to manage ownership securely.