Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Malicious user can drain all contract funds

adamn000

Summary

The contract has functionality to change owner using MysteryBox::changeOwnerfunction. However, this function don't have any only owner protection to allow set new onwer only by the actual owner.

function changeOwner(address _newOwner) public {
owner = _newOwner;
}

Vulnerability Details

User can became the owner of the contract call MysteryBox::changeOwner function. After that, user is the owner and is allowed to withdraw all the money from the contract using MysteryBox::withdrawFunds function.

Impact

All funds deposited in the contract might be lost.

Tools Used

Manual review

Recommendations

Use require statement in the "MysteryBox::changeOwner" function like in the others function in the contract.

function changeOwner(address _newOwner) public {
require(msg.sender == owner, "Only owner can set new owner");
owner = _newOwner;
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can change owner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!