Tadle

Summary

Single-step ownership transfer means that if a wrong address was passed when transferring ownership or admin rights it can mean that role is lost forever. The ownership pattern implementation for the protocol is in Ownable.sol , where a single-step transfer is implemented. This can be a problem for all methods marked in onlyOwner throughout the protocol, some of which are core protocol functionality

Vulnerability Details

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/utils/Rescuable.sol#L12

Impact

Role will lost forever and important protocol functionality will be bricked

Tools Used

Manual Review

Recommendations

It is a best practice to use two-step ownership transfer pattern, meaning ownership transfer gets to a "pending" state and the new owner should claim his new rights, otherwise the old owner still has control of the contract. Consider using OpenZeppelin's Ownable2Step contract