Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Critical Ownership Takeover Vulnerability in MysteryBox Smart Contract

AniketTyagi

Vulnerability Details

Contract Name: MysteryBox
Severity: High
Reported Issue: Unauthorized Owner Change Exploit

Summary

The changeOwner() function in the MysteryBox smart contract allows any user to change the contract's ownership to themselves without any access control. This is a critical vulnerability as an attacker can take over the entire contract, including the ability to withdraw funds, manipulate rewards, and modify contract state.

function changeOwner(address _newOwner) public {owner = _newOwner;}

The lack of ownership verification allows any caller to replace the current owner with their own address, effectively taking control of the contract.

An attacker can exploit this vulnerability by simply calling the changeOwner() function and passing their own address as _newOwner. Once they are the new owner, they can withdraw all funds, modify contract settings, and disrupt the intended operation of the contract.

function testChangeOwnerByAttacker() public {
// Simulate an attack where the attacker sends a transaction to change ownership.
vm.deal(attacker, 1 ether); // Allocate 1 ether to the attacker
vm.prank(attacker); // Execute the next action as the attacker
mysteryBox.changeOwner(attacker); // Attacker takes ownership
assertEq(mysteryBox.owner(), attacker); // Verify attacker is now the owner
}
​

Impact

  • Full contract takeover: The attacker can claim ownership and access all functions restricted to the contract owner, such as withdrawing funds and managing rewards.

  • Financial loss: The attacker can drain the contract balance using the withdrawFunds() function.

  • Disruption of contract logic: The attacker can modify rewards, box prices, and other key contract parameters.

Recommendations

Add access control to the changeOwner() function, restricting its use to the current owner only.

function changeOwner(address _newOwner) public {
require(msg.sender == owner, "Only the current owner can change ownership");
owner = _newOwner;
}
Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can change owner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.