Submission Details
Severity:
Centralization Risk, Caller/Owner of `FjordAuctionFactory::setOwner` function should not be able to set newOwner
Summary
The caller/owner of FjordAuctionFactory::setOwnerthe function should not be authorized to setOwner as they could set themselves as the new owner.
Vulnerability Details
The caller/owner can set themselves as the newOwner of the account with multiple different addresses, this does not allow for proper admin privileges/rights and restrictions to sensitive functions/operation
Impact
Highly Probable
Tools Used
Manual Review
Recommendations
Consider using Openzppelin Access Control library/Interface https://docs.openzeppelin.com/contracts/5.x/access-control#using-access-control
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
66230 USDC / LOC
16,000 USDC
2,500 USDC
1,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.