Submission Details
Severity:
Lack of access control for function changeOwner
Summary
Anyone can become the owner and drain the whole pool
Vulnerability Details
In MysteryBox, there is one function called changeOwner. The function aims to change the owner of this contract.
The problem is that we lack of access control for this function. Anyone can become the owner via this function.
function changeOwner(address _newOwner) public {
owner = _newOwner;
}
Impact
Anyone can become the owner and drain the pool via withdrawFunds().
Tools Used
Manual
Recommendations
Add one onlyOwner modifier for function changeOwner.
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.