Summary

Since changeAdmin is an external function, it can be called from outside the contract, bypassing the msg.sender == admin check

Vulnerability Details

If both the base contract and the derived contract define a public function with the same name (like changeAdmin), Solidity will choose the function from the most derived contract (your contract)

Since changeAdmin is an public function, it can be called from outside the contract, bypassing the msg.sender == admin check

Impact

Tools Used

Recommendations

If needed, use the onlyOwner modifier instead of checking msg.sender == admin manually.