Submission Details
Severity:
H-3 Lack of access control on `MysteryBox::changeOwner` allows anyone to change the owner
Description
In MysteryBox::changeOwner function, there is no access control so anyone can change the owner.
Impact
Anyone can change the owner. Owner has ability to set the price of boxes, add new rewards, and withdraw funds. Anyone can be owner and withdraw funds.
Recommended mitigation
function changeOwner(address _newOwner) public {
+ require(msg.sender == owner, "Only owner can change the owner");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.