Submission Details
Severity:
lack of access controll in the changeOwner function
Summary
Vulnerability Details
https://github.com/Cyfrin/2024-09-mystery-box/blob/main/src/MysteryBox.sol#L111
the changeowner function is used to set a new owner
the changeOwner function lacks access control, that means it can be called by any one, and that is not intented by the protocol
Impact
since the is no access control in the changeOwner function a bad user can call this function and set the new owner of the contract to a malicious address which will disrupt the intended function of the contract
Tools Used
manual
Recommendations
an access controll should be added, making the function to be called by only owner
Updates
Appeal created
inallhonesty 11 months ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.