Mystery Box

First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Submission Details
Severity: high
Valid

Owner address can be changed by anyone and the new owner can steal all the funds in the contract.

Summary

There is no access control on MysteryBox::changeOwnerfunction. This means that anyone can change the owner address to their wallet address and steal all the funds in the contract.

Vulnerability Details

There is no access control on MysteryBox::changeOwnerfunction. This allow anyone to change the owner address to their wallet address and call MysteryBox::withdrawFunds to steal all the funds in the contract. The new owner can also call MysteryBox::setBoxPrice and MysteryBox::addRewardto change box price and add rewards as he desires.

Impact

All funds in the contract will be lost.

Tools Used

Manual review

Recommendations

Add access control to MysteryBox::changeOwner as shown below.

function changeOwner(address _newOwner) public {
+ require(msg.sender == owner, "Only owner is allowed");
owner = _newOwner;
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can change owner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!