GivingThanks

Summary

The GivingThanks contract was originally implemented without leveraging OpenZeppelin's Ownable contract for ownership management. Instead, it manually defined address public owner and set owner = msg.sender in the constructor. This approach was intended to restrict certain functionalities to the contract owner but lacked the robustness of the Ownable contract provided by OpenZeppelin.

Vulnerability Details

The contract initially declared address public owner; and set owner = msg.sender; in the constructor.

• It did not use OpenZeppelin's Ownable contract, leading to a lack of standard ownership modifiers like onlyOwner.

You don't need to set owner = msg.sender; manually if you inherit from Ownable because the Ownable constructor already sets the owner to the deployer's address.

Impact

Missing onlyOwner modifier for functions that should be restricted.

The contract fails to enforce the correct access control, leading to potential misuse.

Tools Used

Manual Review

Recommendations

Changed the contract definition