Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted Ownership Transfer

0xserpent

Summary

The changeOwner() function allows anyone to transfer ownership of the contract, leading to the potential hijacking of the contract.

Vulnerability Details

The changeOwner() function does not have any authorization check, allowing any user to change the owner to an arbitrary address:

function changeOwner(address _newOwner) public {
owner = _newOwner;
}

Impact

Anyone can call this function to take control of the contract, allowing them to manipulate box prices, withdraw funds, and make other administrative changes. This could lead to a complete loss of control for the original owner and potential misuse of the contract.

Tools Used

Manual code review

Recommendations

Add an authorization check to ensure that only the current owner can change ownership:

require(msg.sender == owner, "Only the current owner can change ownership");
Updates

Lead Judging Commences

inallhonesty Lead Judge
11 months ago

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can change owner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.