Submission Details
Severity:
The 'changeOwner' function should only owner can execute
Summary
The 'changeOwner' function every one can execute,should only contract owner can execute.
Vulnerability Details
The function changeOwner not jugde msg.sender authority, the msg.sender should be contract owner.
function changeOwner(address _newOwner) public {
owner = _newOwner;
}
Impact
The contract may be control by new malice owner. example,modify boxPrice by execute setBoxPrice, and will lost fund in contract.
Tools Used
Manual
Recommendations
Add verify msg.sender condition.
function changeOwner(address _newOwner) public {
+ require(msg.sender == owner, "Only owner can change owner");
owner = _newOwner;
}
}
Updates
Appeal created
inallhonesty 11 months ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.