Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can set himself as the owner.

SfT

Summary

MysteryBox.changeOwner() function doesn't check authority of the caller. Therefore attacker can change owner to himself.

Vulnerability Details

Since there is no restriction on the changeOwner function, the user can reset any address as the owner.
MisteryBox.sol(111~113)

function changeOwner(address _newOwner) public {
owner = _newOwner;
}

Impact

After attacker set himself as the owner, he can call the setBoxPrice function to set the price of the box to any price, so attacker can buy the box at an unintended price (close to 0).
Futhermore, attacker can withdraw all ethers of the contract by calling withdrawFunds() function.

Tools Used

Manual Review

Recommendations

Modify the changeOwner() function as follows.

function changeOwner(address _newOwner) public {
[+] require(msg.sender == owner, "Only owner can change owner to new owner");
owner = _newOwner;
}
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can change owner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!