Mystery Box

Summary

There is no access control in the changeOwner function

Vulnerability Details

The changeOwner function changes the current owner to a new owner but the current implementation does not have an access control meaning anybody can call it and change the owner to any address

Impact

A malicious actor can change the current owner to their controlled address making him steal funds via withdrawFunds and call the onlyOwnerfunctions like setBoxPrice and addReward.

Tools Used

Manual review

Recommendations

Implement an access modifier like the onlyOwnerto control who can call the restricted function