Submission Details
Severity:
Incorrect contract upgrade setup
Summary
The function _authorizeUpgrade lacks the checks to verify that it is only called by the owner.
Vulnerability Details
function _authorizeUpgrade(address) internal view override {}
The _authorizeUpgrade should be only called by the owner so that only the owner can upgrade the contract but it lacks any such checks .
Impact
Anyone can upgrade the contract.
Tools Used
VS code
Recommendations
- function _authorizeUpgrade(address) internal view override {}
+ function _authorizeUpgrade(address) internal view override onlyOwner {}
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
_authorizeUpgrade(address) lacks access control in mock contracts
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.