Flow
Sablier
FoundryDeFi
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Admin role should be transferred via a two-step process.

yeboahnat99

Summary

Admin MUST be transferred via a two-step process.

Vulnerability Details

The admin address carries numerous important abilities for the system.
However the transferAdmin function in IAdminable contract allows the admin address to be errantly transferred to the wrong address as it does not use a two-step transfer process.

Impact

Admin address can be errantly transferred to the wrong address leading to lost of collected ProtocolRevenue. Also the protocolfee can not be set.

Tools Used

Manual Review

Recommendations

function transferAdmin(address newAdmin) public virtual override onlyAdmin {
// Effect: update the admin.
@>> admin = newAdmin;
​
// Log the transfer of the admin.
emit IAdminable.TransferAdmin({ oldAdmin: msg.sender, newAdmin: newAdmin });
}

Recommended Mitigation:

  1. Implement a two-step transfer process. Use the openzeppelin ownable2step contract.

  2. It is important to make this function timelocked as it is a criticial function shown in LightChaser in Low-13.

Updates

Lead Judging Commences

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.