Summary

Any user can retrieve the admin role for the Godfather by calling the function retrieveAdmin

Vulnerability Details

According to the documentation, only the Godfather should be able to call that function and only when he needs it.
”This contract is the admin of Kernel.sol to grant and revoke roles. A function permit the godfather to retrieve the admin role when needed.”

Impact

The Godfather lose the control over retrieving the Admin role

Tools Used

Manual review

Recommendations

Make this change to the code:

• function retrieveAdmin() external {

• function retrieveAdmin() external isGodFather {
  kernel.executeAction(Actions.ChangeAdmin, kernel.executor());
  }