Submission Details
Severity:
Lack of access control for `changeOwner`
Summary
Lack of access control for changeOwner allows anyone to transfer ownership and control of the contract.
Vulnerability Details
changeOwner function can be called by anyone, meaning anyone can take over the ownership of the contract.
Impact
Anyone can take over the ownership of the contract, so they can change prices and withdraw funds without any permission.
Tools Used
Manual review.
Recommendations
Restrict access to the changeOwner function so that only the current owner can call it:
function changeOwner(address _newOwner) public {
require(msg.sender == owner, "Only owner can change ownership");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.