Summary

The AuctionFactory, FjordPoints, and FjordStaking contracts manage ownership through a single-step ownership transfer function. Given the contract's non-upgradeable nature, a single-step ownership transfer introduces significant risks if an error occurs or if malicious actions are taken.

Vulnerability Details

Mentioned contracts contain a single-step function setOwner for transferring ownership:

The current implementation allows ownership to be transferred in one step. If the function is called with an incorrect address, there is no way to revert the transfer once executed.

Impact

Mistakes in transferring ownership cannot be easily corrected, as there is no mechanism to revert the change or undo an incorrect ownership transfer.

Tools Used

Manual review.

Recommendations

Implement a two-step ownership transfer process. This approach adds an additional layer of security by requiring confirmation of ownership changes, thus preventing accidental or unauthorized transfers.