Submission Details
Severity:
Missing access control on changeOwner
Summary
Anyone can become owner by simply calling changeOwner due to missing access control.
Vulnerability Details
Anyone can become owner and then withdraw all funds.
Impact
Loss of funds for the contract.
Tools Used
Foundry
Recommendations
Require that only the owner can call changeOwner and even in that case, a 2 step ownership transfer process should be implemented where the new owner has to accept their new position as owner to ensure that the new owner is an active account.
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.