Submission Details
Severity:
Admin Role Changes Should Be Two Step
Summary
GivingThanks uses Single-step ownership transfer which can be dangerous.
Vulnerability Details
The admin address carries numerous important abilities for the system.
However the changeAdmin function allows the admin address to be errantly transferred to the wrong address as it does not use a two-step transfer process.
Impact
protocol will be bricked
Tools Used
manual
Recommendations
Implement a two step “push” and “pull” admin transfer process.
Rewards breakdown
nSLOC
67This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.