First Flight #10: One Shot

Summary

Contracts have owners with privileged rights to perform admin tasks and need to be trusted to not perform malicious updates or drain funds.

Vulnerability Details

• Found in src/OneShot.sol Line: 10

  contract OneShot is IOneShot, ERC721URIStorage, Ownable {

• Found in src/OneShot.sol Line: 20

  function setStreetsContract(address streetsContract) public onlyOwner {

Impact

If the owner's address is compromised, the supply could be manipulated by the attacker.

Tools Used

Aderyn

Recommendations

Modify the access controls to decentralize the protocol