First Flight #12: Kitty Connect

Summary

The KittyConnect contract is using custom modifier onlyKittyConnectOwner modifier instead of onlyOwner from OpenZeppelin. This could lead to vulnerabilities if not implemented correctly.

Vulnerability Details

The onlyOwner modifier from OpenZeppelin enforces that only the contract owner can execute the function. A custom modifier like onlyKittyConnectOwner likely tries to accomplish the same goal, but may be vulnerable.

Since onlyOwner is well-tested and audited, a custom modifier likely introduces more risk.

Impact

If onlyKittyConnectOwner is poorly implemented, it could allow unauthorized accounts to execute privileged functions.

Tools Used

Manual Review

Recommendations

Use onlyOwner from OpenZeppelin for clear and standardized access control.

Import Ownable from OpenZeppelin library

Add inheritance to the contract

Add onlyOwner modifier instead of onlyKittyConnectOwner in KittyConnect::addShop function