Submission Details
Severity:
Unrestricted Ownership Transfer
Summary
The changeOwner function allows anyone to change the contract's ownership without restrictions or authorization checks.
Vulnerability Details
MysteryBox.sol/Line
Impact
Anyone can call this function and take control of the contract, leading to loss of control for the original owner, and potentially leading to malicious actions like withdrawing all funds.
Tools Used
Foundry
Recommendations
Add an ownership check to ensure only the current owner can change ownership :
require(msg.sender == owner, "Only owner can change ownership");
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.