Sablier
Sablier
DeFiFoundry
53,440 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Use two-step owner transfer

twcctop

Summary

Using two-step ownership transfer is recommand when amin role palys a critical role in the contract.

Vulnerability Details

Current implemantation of the transferAdmin function allows the admin to be changed in a single step.

function transferAdmin(address newAdmin) public virtual override onlyAdmin {
// Effect: update the admin.
@> admin = newAdmin;
​
// Log the transfer of the admin.
emit IAdminable.TransferAdmin({ oldAdmin: msg.sender, newAdmin: newAdmin });
}
​
​

admin role is used in function setNFTDescriptor, which plays a critical role in the contract.

once newAdmin is wrongly set, function setNFTDescriptor can be called by the wrong admin, which can lead to a critical vulnerability.

Impact

function setNFTDescriptor can be called by the wrong admin

Tools Used

manual

Recommendation

use two-step ownership transfer to avoid the vulnerability.
refer:
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/access/Ownable2Step.sol

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Info/Gas/Invalid as per Docs

https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.