Submission Details
Severity:
Anyone can change owner
Relevant GitHub Links
https://github.com/Cyfrin/2024-09-mystery-box/blob/main/src/MysteryBox.sol#L111
Summary
Anyone can call the MysteryBox::changeOwner function and change the contract’s owner. After that, the new owner (attacker) gains access to all onlyOwner functions and can steal funds by calling MysteryBox::withdrawFunds.
Impact
An attacker can exploit this by calling MysteryBox::changeOwner, setting themselves as the owner, and then calling MysteryBox::withdrawFunds to steal funds.
Recommendations
Add a check in the MysteryBox::changeOwner function to verify that the msg.sender is the current owner:
function changeOwner(address _newOwner) public {
+ require(msg.sender == owner, "Only owner can change owner");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.