Mystery Box
First Flight #25
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of Access Control on `changeOwner` Function Leading to Unauthorized Ownership Transfer

myssteeque

Description

The changeOwner function lacks an access control mechanism, allowing any user to call the function and update the contract's owner. This issue creates a significant security risk, as unauthorized users can seize control of the contract, leading to potential misuse or exploitation of critical functions restricted to the owner.

​
function changeOwner(address _newOwner) public {
owner = _newOwner;
}
​

Impact

Since there is no restriction on who can call the changeOwner function, anyone can transfer the ownership of the contract. This could lead to severe consequences, such as:

  • Unauthorized users gaining full control over the contract.

  • Malicious actors taking ownership and altering contract behavior, draining rewards/funds, or locking out legitimate users.

Proof Of Concept

  • Assume a contract deployed with address A as the initial owner.

  • Any external user, say address B, can call the changeOwner function.

  • address B executes changeOwner(B), successfully transferring ownership to themselves, despite not being the original owner.

Tools Used

Manual review

Recommended Mitigation

Use an access control modifier to ensure that only the current owner can update/change the owner.

modifier onlyOwner() {
require(msg.sender == owner, "Not the owner");
_;
}
​
function changeOwner(address _newOwner) public onlyOwner {
owner = _newOwner;
}
Updates

Appeal created

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can change owner

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.