Submission Details
Severity:
Anyone can call the `changeOwner()` function
Summary
There is a changeOwner() function which is set to public, therefore anyone can call the function and become the owner and perform all the actions such as set the price of boxes, add new rewards, and withdraw funds.
Vulnerability Details
a public changeOwner() function in line 111 of MysteryBox.sol
Impact
anyone can call the function and become the owner and perform all the actions such as set the price of boxes, add new rewards, and withdraw funds.
Tools Used
None :- manual reading of the contract
Recommendations
change the function visibility to private or can just remove the function.
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.