Submission Details
Severity:
Use two step ownership transfer
Summary
The Adminable.sol contract allows the current admin to transfer the admin rights to other user/ new admin. How ever it does not follow the security standard of ownership transferring.
Vulnerability Details
Lets have a look at transferAdmin function :
function transferAdmin(address newAdmin) public virtual override onlyAdmin {
// Effect: update the admin.
admin = newAdmin; // @audit-issue : single step ownership trasnfer
// Log the transfer of the admin.
emit IAdminable.TransferAdmin({ oldAdmin: msg.sender, newAdmin: newAdmin });
}
There is no zero address check and also no two step transfer flow.
Impact
The single step transfer of admin role is vulnerable to wring transfers like the address does not exist or to address(0).
Tools Used
Manual Review
Recommendations
Add two step transfer flow and also add check for address(0) for safety.
Updates
Lead Judging Commences
inallhonesty 12 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Known - LightChaser
https://github.com/Cyfrin/2024-05-Sablier/issues/1
Prize pool breakdown
Total prize
53,440 USDC
nSLOC
2,65520 USDC / LOC
45,000 USDC
3,100 USDC
5,340 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.