Submission Details
Severity:
Unrestricted Owner Change
Summary
The changeOwner function allows anyone to change the contract owner, leading to a complete loss of control over the contract.
Vulnerability Details
The changeOwner function has no access control, allowing any address to call it and change the owner:
function changeOwner(address _newOwner) public {
owner = _newOwner;
}
Impact
High. An attacker can take control of the contract, potentially draining all funds and manipulating the reward system.
Tools Used
Manual code review
Recommendations
Add access control to the changeOwner function:
function changeOwner(address _newOwner) public {
require(msg.sender == owner, "Only current owner can change ownership");
owner = _newOwner;
}
Use OpenZeppelin's Ownable contract to handle ownership management securely.
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.