Mystery Box

Summary

The changeOwner() function in the MysteryBox contract allows any user to transfer ownership of the contract without restriction. This behavior contradicts the documentation, which states that neither the admin nor the user should have the permission to change ownership. The lack of access control in this function poses a significant security risk, as it enables any user to assume control of the contract, potentially leading to malicious activities, including withdrawing funds or altering critical contract parameters.

Vulnerability Details

The changeOwner() function in the contract is defined as:

Key Issue:

• There is no access control on the changeOwner() function, meaning any user can call it and set themselves (or any address) as the new owner of the contract.

• This behavior directly contradicts the documented intent, which specifies that users and admins should not have permission to change ownership.

This lack of restriction allows attackers to take over the contract and perform sensitive actions, such as withdrawing all funds using the withdrawFunds() function or modifying other administrative settings (e.g., setBoxPrice() and addReward()).

Example Scenarios

Unauthorized Ownership Change Scenario:

Initial Setup: An attacker notices that the changeOwner() function is callable by anyone.

Execution: The attacker calls the changeOwner() function, passing their own address as the new owner

Outcome: The attacker becomes the contract's owner and can now perform sensitive administrative actions, including withdrawing all funds from the contract

Impact

Complete loss of control: Any user can take ownership of the contract, leading to complete loss of control for the original owner.

• Loss of funds: An attacker who gains ownership can withdraw all funds from the contract.

• Unauthorized modification of contract parameters: The attacker can modify parameters such as boxPrice and add or remove rewards, damaging the contract's integrity and trustworthiness.

Tools Used

Manual Review

Recommendations

Add Ownership Access Control:

This ensures that only the legitimate owner has the permission to transfer ownership, aligning with the intended behavior documented in the contract's specification.