Summary

Lack of two-step role transfer on TempleGold.soland TempleTeleporter.sol

Vulnerability Details

TempleGold.soland TempleTeleporter.sol in scope have imported the Ownable.sol contract forked from OZ which means they lack two-step role transfer. The ownership transfer should be done with great care and two-step role transfer should be preferable.

Impact

https://github.com/Cyfrin/2024-07-templegold/blob/6c3980a0486c01114d0ef1281df188b6c01991e6/protocol/contracts/templegold/TempleGold.sol#L68

https://github.com/Cyfrin/2024-07-templegold/blob/6c3980a0486c01114d0ef1281df188b6c01991e6/protocol/contracts/templegold/TempleTeleporter.sol#L29

Tools Used

Manual Review

Recommendations

Use Ownable2Step by OpenZeppelin.(openzeppelin-contracts/contracts/access/Ownable2Step.sol at master · OpenZeppelin/openzeppelin-contracts · GitHub)