Submission Details
Severity:
Lack of Proper Access Control on changeOwner
Summary
The SpookySwap::changeOwner function provides a way for the owner to transfer ownership but without any validation or safeguards.
Impact
The owner might accidentally transfer ownership to an zero address making it impossible to call functions with onlyOwner modifier.
Tools Used
Manual review
Recommendations
Add validation to ensure that _newOwner is not the zero address before transferring ownership.
function changeOwner(address _newOwner) public onlyOwner {
+ require(_newOwner != address(0), "New owner cannot be the zero address");
transferOwnership(_newOwner);
}
Rewards breakdown
nSLOC
109This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.