Summary

Contracts have owners with privileged rights to perform admin tasks and need to be trusted to not perform malicious updates or drain funds.

##Vulnerability Detail

• Found in CredToken.sol

  contract Credibility is ERC20, Ownable {

• Found in CredToken::setStreetsContract

  function setStreetsContract(address streetsContract) public onlyOwner {

• Found in OneShot

  contract OneShot is IOneShot, ERC721URIStorage, Ownable {

• Found in OneShot::setStreetsContract

  function setStreetsContract(address streetsContract) public onlyOwner {

Impact

• Potential loss of funds

Tools Used

Aderyn

Recommendation

Make RapBattle::oneShotNft and RapBattle::credToken immutables