MorpheusAI

Summary

Owner could make incorrect transfer ownership to wrong account.

Vulnerability Details

The ownership of the contracts can be lost as the contracts inherits from the OwnableUpgradeable contract and their ownership can be transferred in a single-step process. The address the ownership is changed to should be verified to be active or willing to act as the owner

Impact

If the nominated EOA account is not a valid account, it is entirely possible that the owner may accidentally transfer ownership to an uncontrolled account, losing the access to all functions with the onlyOwner modifier.

Tools Used

Manual review

Recommendations

Consider using the Ownable2StepUpgradeable.sol ( https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/contracts/access/Ownable2StepUpgradeable.sol ) library over the OwnableUpgradeable library or implementing similar two-step ownership transfer logic into the contract