Centralization Risk for Trusted Owners Break Business Logic
Summary
The contract is presented as decentralized and secure. However, it has certain features that contradict this claim, including upgradability and the presence of a trusted owner (admin) with special privileges
Vulnerability Details
The contract is described as decentralized and with robust security even though the contracts are upgradable and there is a trusted owner (admin) with special privileges. The presence of these features introduces potential centralization and security risks. The upgradability allows the contract to be altered after deployment. These aspects can undermine the decentralization and security claims making the contract contradict the promised.
Tools Used
Maniual review.
Recommendations
Remove Upgradability: Consider deploying a non-upgradable version of the contract to eliminate the risk of post-deployment alterations.
Implement Multi-Signature Controls: If upgradability is necessary, implement multi-signature controls for the admin functions to reduce the risk of a single point of failure.
Decentralize Admin Privileges: Distribute admin privileges among multiple trusted parties or eliminate them altogether to enhance decentralization.
Increase Transparency: Clearly communicate the existence of upgradability and admin controls to users, so they are aware of the potential risks involved.
Lead Judging Commences
[invalid] finding-Admin-Errors-Malicious
The following issues and its duplicates are invalid as admin errors/input validation/malicious intents are1 generally considered invalid based on [codehawks guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). If they deploy/set inputs of the contracts appropriately, there will be no issue. Additionally admins are trusted as noted in READ.ME they can break certain assumption of the code based on their actions, and
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.