Summary

Contracts have owners with privileged rights to perform admin tasks and need to be trusted to not perform malicious updates.

• Found in src/KittyBridge.sol Line: 18

  contract KittyBridge is KittyBridgeBase, CCIPReceiver, Ownable {

• Found in src/KittyBridge.sol Line: 33

  function allowlistDestinationChain(uint64 _destinationChainSelector, bool allowed) external onlyOwner {

• Found in src/KittyBridge.sol Line: 38

  function allowlistSourceChain(uint64 _sourceChainSelector, bool allowed) external onlyOwner {

• Found in src/KittyBridge.sol Line: 43

  function allowlistSender(address _sender, bool allowed) external onlyOwner {

• Found in src/KittyBridge.sol Line: 115

  function updateGaslimit(uint256 gasLimit) external onlyOwner {

Impact

Medium.

Tools Used

Aderyn static analyzer.

Recommendations

Use a multi-sig wallet for the owner role, and an Ownable library to have ability to change address of owner.