Mystery Box

Summary

There is no access control on changeOwner().

Vulnerability Details

The changeOwner function does not verfiy the caller before updating the owner address.

Impact

This will allow anyone to call this function and make themselves the owner of the contract. This will then allow them to immediately call withdraw() and drain the contract of its balance.

Tools Used

Manual Review

Recommendations

Update changeOwner() by adding the following:

require(msg.sender == owner);