Submission Details
Severity:
Unauthorized access to changeOwner function
Summary
The changeOwner function allows any external caller to change the ownership of the contract. This exposes the contract to malicious actors, who can call this function to take over ownership without authorization. This creates a significant security vulnerability, potentially leading to complete loss of control over the contract.
Vulnerability Details
function changeOwner(address _newOwner) public {
owner = _newOwner;
}
Impact
Any address is able to change ownership, regardless of whether it is the current owner.
Tools Used
Manule review
Recommendations
Add a require statement to ensure that only the current owner can call this function:
function changeOwner(address _newOwner) public {
require(msg.sender == owner, "Only the owner can change ownership");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.