Submission Details
Severity:
Lack of Access Control due to be drained all funds
Summary
There are so administering function require that msg.sender is MysteryBox::owner such as setBoxPrice, addReward,withdrawFunds. However, the function MysteryBox::changeOwner which is used to move to new owner is lack of an access control. Because of it, malicious user can drain all funds.
Vulnerability Details
Proof of Concept
Malicious user calls
changeOwnerfunction to change owner to your appreciation.They calls
withdrawFundsfunction to withdraw all contract balance.
Impact
The contract's balance will be drained.
Tools Used
Manual Review
Recommendations
Adding an access control to the changeOwner function.
function changeOwner(address _newOwner) public {
+ require(msg.sender == owner, "Only owner can change ownership");
owner = _newOwner;
}
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.