[EVMN] Everyone Can Become Owner
Summary
An arbitrary user can escalate their role as the contract owner that has a complete control over the contract.
Vulnerability Details
Function changeOwner() allows everyone to change the owner address. This allows the new owner to execute damaging actions to the contract, such as draining assets. This is because the function changeOwner() does not have any access control to limit the function access to a certain party (most likely the current owner).
Impact
A user takes over the contract ownership and drains the contract's assets.
Tools Used
Manual review.
Recommendations
Consider adding an access control to limit the access to the function.
Appeal created
Anyone can change owner
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.