Submission Details
Severity:
Everyone can set the owner of the `MysteryBox` contract
Summary
Every user can set the owner of `MysteryBox` contract. There aren't any restrictions wheter msg.sender == currentOwner
Impact
Every user can make himself as owner and withdraw contract funds.
Tools Used
Foundry and solidity. Add the following code inside TestMysteryBox.t.sol:
<details>
<summary>Code</summary>
```javascript
function testchangeOwner_NotOwnerCanSetTheNewOwner() public {
vm.prank(user1);
mysteryBox.changeOwner(user1);
assertEq(mysteryBox.owner(), user1);
}
```
</details>
Recommendations
Add check wheter msg.sender == currentOwner or add modifier to execute the check.
```diff
function changeOwner(address _newOwner) public {
+ require(msg.sender == owner);
owner = _newOwner;
}
```
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.