Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Improper access control of changeOwner()

murelel

Summary

A high-severity vulnerability was discovered in the (MysteryBox) smart contract, where the (changeOwner) function is public and allows any user to modify the owner of the contract.

Vulnerability Details

(changeOwner) does not has any access control and any user can call it.

function changeOwner(address _newOwner) public {
owner = _newOwner;
}

Impact

Changing the owner of the contracts allows the attacker to extract all the funds stored in the contract with the (withdrawFunds) function, that need to be called by the owner of the contract.

PoC

function testChangeOwner_AccessControl() public {
vm.prank(user1);
mysteryBox.changeOwner(user1);
assertEq(mysteryBox.owner(), user1);
}

Tools Used

Manual Analysis

  • Foundry: Smart contract testing and simulation framework

Recommendations

Add the following line to the very beginning of the changeOwner() function:

require(msg.sender == owner, "Only owner can change the owner");
Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can change owner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.