Vulnerability Details

Single-step ownership transfers add the risk of setting an unwanted owner by accident (this includes address(0)) if the ownership transfer is not done with excessive care.

Context:

1. https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/Distribution.sol#L15C1-L16C1

2. https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/L1Sender.sol#L15C1-L16C1

3. https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/L2MessageReceiver.sol#L10

4. https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/L2TokenReceiver.sol#L13

5. https://github.com/Cyfrin/2024-01-Morpheus/blob/main/contracts/MOR.sol#L10

https://solodit.xyz/issues/l-07-use-ownable2step-instead-of-ownable-for-access-control-code4rena-particle-protocol-particle-protocol-invitational-git

https://solodit.xyz/issues/l-04-use-code4rena-redacted-cartel-redacted-cartel-contest-git

Impact

If the new address is inactive or not willing to act, there is no way to restore access to that role. Therefore, the owner role can be lost.

Tools

Manual Review

Recommendation

It is recommended to use the Ownable2Step library instead of Ownable library.