Submission Details
Severity:
Anybody can become the owner and withdraw all the funds among other restricted actions
Summary
ChangeOwner function has no access control and can be called by anyone, hence anybody can become the owner and call sensitive functions that would allow them to manipulate rewards but most importantly withdraw all the funds.
function changeOwner(address _newOwner) public {
owner = _newOwner;
}
Vulnerability Details
Impact
Critical, anybody can become the owner and hence be able to change the price, add rewards, and most importantly withdraw all the funds
function withdrawFunds() public {
require(msg.sender == owner, "Only owner can withdraw");
(bool success,) = payable(owner).call{value: address(this).balance}("");
require(success, "Transfer failed");
}
Tools Used
Manual review
Recommendations
Allow only the owner to change the owner (add a conditional revert so that function reverts if msg.sender is not the owner), and at best user Owner2Step to ensure safe ownership transfers
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.