Submission Details
Severity:
Owner address can be changed by anyone and the new owner can steal all the funds in the contract.
Summary
There is no access control on MysteryBox::changeOwnerfunction. This means that anyone can change the owner address to their wallet address and steal all the funds in the contract.
Vulnerability Details
There is no access control on MysteryBox::changeOwnerfunction. This allow anyone to change the owner address to their wallet address and call MysteryBox::withdrawFunds to steal all the funds in the contract. The new owner can also call MysteryBox::setBoxPrice and MysteryBox::addRewardto change box price and add rewards as he desires.
Impact
All funds in the contract will be lost.
Tools Used
Manual review
Recommendations
Add access control to MysteryBox::changeOwner as shown below.
function changeOwner(address _newOwner) public {
+ require(msg.sender == owner, "Only owner is allowed");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.