Submission Details
Severity:
Private `KittyCoin::pool` variable initialization
Description: The KittyCoin::pool address is set only during contract deployment and cannot be changed thereafter. The pool address is set only once during contract initialization. If this address needs to be changed (e.g., due to a key compromise or pool upgrade), there is no way to do so.
Impact: Inability to update the pool address in case of an emergency, leading to potential loss of control over minting and burning capabilities.
Recommended Mitigation: Introduce a function to update the pool address with appropriate access control.
function setPool(address _newPool) external onlyKittyPool {
require(_newPool != address(0), "Invalid address");
pool = _newPool;
}
Rewards breakdown
nSLOC
224This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.