The Standard

Summary

Only owner can change the ownership of the contract otherwise other function which are onlyOwner does not make sense if ,Manager can change owner anytime he want.

Vulnerability Details

currently onlyVaultManager is access control on setOwner function which allow Manage to make new owner of this contract which deployed by someone for his used.

Impact

Let suppose I am manager , go and change the owner do some transactions and revert the old owner this function make me think to lose the purpose on onlyowner access which stop other to access but what about Manager.

Tools Used

Manuel Review

Recommendations

Either remove it or only current owner can change it , or atleast both should have access of the functions.