Submission Details
Severity:
Lack Of Zero Address Check In `MysteryBox::changeOwner` Can Lead To Loss Of Ownership.
Summary
The changeOwner function does not validate the _newOwner parameter, allowing the contract owner to be set to the zero address, effectively disabling ownership.
Vulnerability Details
Lack of zero-address check in changeOwner could lead to loss of ownership:
function changeOwner(address _newOwner) public {
owner = _newOwner; // No validation for the zero address
}
Impact
Assigning the zero address as the owner can leave the contract without an owner, potentially preventing further ownership changes or administrative actions. This could lead to a loss of control over the contract.
Tools Used
Manual Review
Recommendations
Add a validation check to ensure the _newOwner is not the zero address:
function changeOwner(address _newOwner) public {
+ require(_newOwner != address(0), "Invalid new owner");
owner = _newOwner;
}
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.