Dria

Summary

The onlyAuthorized modifier in the contract appears to contain incorrect logic for checking authorization. Specifically, the && (AND) operator is used in a way that likely results in overly restrictive access control. This could prevent authorized users from calling certain functions, as only accounts that are both operators and owners are granted access. Replacing this with the || (OR) operator would ensure that the caller is authorized if they meet either condition, as intended.

Vulnerability Details

In the following line:

The && operator checks that the caller is neither an operator nor the owner, meaning only those meeting both conditions are granted access. However, the intended logic is likely to grant access if the caller is either an operator or the owner. Changing && to || would correctly allow either of these roles to pass the check, improving function access reliability.

Impact

It impacts access control for functions protected by onlyAuthorized. If not corrected, this issue could restrict operator access, rendering these functions inaccessible.

Tools Used

Manual code review

Recommendations

Change && to || to properly grant access when the caller is either an operator or the owner, as follows: