Fjord Token Staking

Summary

owner could be mistakenly set to the wrong address, if owner sets newOwner to the wrong address, ownership could be completely lost.

Vulnerability Details

In the FjordStaking.sol contract setOwner function sets the newOwner address directly to owner.

• if the owner passes a wrong newOwner.

• Since the setOwner contract is one-step there is no way to recover the ownership of the contract and its completely lost.

Impact

Ownership of contract could be lost when wrong newOwner is set.

Tools Used

Manual Review

Recommendations

setOwner should set newOwner to a variable newOwner, then a function acceptOwnership which only the newOwner can call, when acceptOwnership is called it then set newOwner to owner, then newOwner is set to address(0)