Submission Details
Severity:
TempleGoldAdmin lacks transferOwner and renounce owner functions.
Summary
Vulnerability Details
TGLD contract imports an Ownable contract which is set to TempleGoldAdmin but it can never be changed because templeGoldAdmin doesn't have functions to change it.
function renounceOwnership() public virtual onlyOwner {
_transferOwnership(address(0));
}
/**
* @dev Transfers ownership of the contract to a new account (`newOwner`).
* Can only be called by the current owner.
*/
function transferOwnership(address newOwner) public virtual onlyOwner {
if (newOwner == address(0)) {
revert OwnableInvalidOwner(address(0));
}
_transferOwnership(newOwner);
}
Impact
owner cannot be changed
Tools Used
manual
Recommendations
add functions that can call renounceOwnership and transferOwnership functions in the TempleGoldAdmin contract.
function transferOwner(address _newOwner) external onlyElevatedAccess {
IOwnable(address(templeGold)).transferOwnerShip(_newOwner);
}
function renounceOnwership() external onlyElevatedAccess {
IOwnable(address(templeGold)).renounceOwnership();
}
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.