Submission Details
Severity:
Protocol can be lost due to lack of validation in the `changeOwner` function.
Summary
there is no validation in changeOwner() function to ensure that ownership is not lost.
Vulnerability Details
The changeOwner function is used to change the contract owner to a new owner. But the issue here is that anyone can call changeOwner() and set themselves as the owner of the contract thereby stealing the protocol.
function changeOwner(address _newOwner) public {
owner = _newOwner;
}
Impact
Ownership is lost
Tools Used
Manual review
Recommendations
Use the onlyOwnermodifier or implement checks that ensures that only the contract owner can call the function to transfer ownership.
// Define the 'onlyOwner' modifier
modifier onlyOwner() {
require(msg.sender == owner, "Caller is not the owner");
_;
}
function changeOwner(address _newOwner) public onlyOwner {
require(_newOwner != address(0), "New owner cannot be the zero address");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.