`Adminable::transferAdmin` function should confirm whether the new admin is correct
Summary
The Adminable::transferAdmin is supposed to change the administrator. But this function might be executed with an incorrect address which can lead to a loss of admin rights.
Vulnerability Details
The Adminable::transferAdmin function updates the admin address without any confirmation on Line 36 of the Adminable contract.
Impact
If a wrong address is given the protocol admin role will be lost. The likelihood is Low, but the impact on the protocol will be Medium to High. There is no way to revert to the previous admin. Although, this issue might be considered as a design choice, it is certainly not a goood practice and must be avoided.
Tools Used
Manual Review
Recommendations
Set the new admin address only after a confirmation from the new address. This way it will not be possible to lose the admin rights.
Lead Judging Commences
Info/Gas/Invalid as per Docs
https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.