Submission Details
Severity:
_authorizeUpgrade missing access control
Summary
It doesn’t have any access control and if you leave it just like that,anybody will be able to come and change the implementation contract to any different arbitrary contract.
Therefore, check if it has access control if you see it overridden.
Vulnerability Details
https://docs.openzeppelin.com/contracts/4.x/api/proxy#UUPSUpgradeable-_authorizeUpgrade-address-
Impact
It doesn’t have any access control and if you leave it just like that,anybody will be able to come and change the implementation contract to any different arbitrary contract.
Tools Used
Manual review
Recommendations
Add onlyOwner control permissions
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
_authorizeUpgrade(address) lacks access control in mock contracts
Prize pool breakdown
Total prize
22,500 USDC
nSLOC
1,05421 USDC / LOC
20,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.