Submission Details
Severity:
anybody can take over the ownership of the protocol
Summary
Since MysteryBox::changeOwner doesn't have any form of verification, any malicious user can hijack the protocol
Vulnerability Details
A random user can take over the protocol and have access to all the exclusive functions in the protocol. She can then call MysterBoxy::WithdrawFunds, MysteryBox::SetPrice, MysteryBox::addReward and all the exclusive and delegate functions thereby causing all havok to the protocol and the users
PoC
function testChangeOwner_AccessControl() public {
vm.startPrank(user1);
mysteryBox.changeOwner(user1);
// change the price of box
mysteryBox.setBoxPrice(0 ether);
assertEq(mysteryBox.owner(), user1);
stopPrank();
}
Impact
loss of funds for protocol
loss of funds for users
Tools Used
manual review
foundry test
Recommendations
function changeOwner(address _newOwner) public {
+ require(msg.sender == owner, "Unauthorized user");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty 8 months ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.