Submission Details
Severity:
Lack of access control in `changeOwner` function
Summary
Any actor is able to call function changeOwner and obtain owner role.
Vulnerability Details
Relevant Code
The vulnerability exists in the changeOwner function, as it is a public function without the required protection. Any malicious actor can call the function and obtain the owner role.
Impact
The owner role is able to call access controled functions as setBoxPrice and withdrawFunds. As any user is able to obtain owner role, it can ultimately drain the contract's funds.
Tools Used
Manual Review
Recommendations
Add a require statement to only let the owner update the owner.
function changeOwner(address _newOwner) public {
+ require(msg.sender == owner, "Only owner can update owner");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.