Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

renounceRole is not revoked

peanuts

Summary

Protocol uses AccessControl but does not revoke renounceRole(). The admin, especially the DEFAULT_ADMIN_ROLE can accidentally renounce his role.

Vulnerability Details

AccessControl is used.

contract MembershipFactory is AccessControl, NativeMetaTransaction {

Anybody can call renounceRole()

function renounceRole(bytes32 role, address callerConfirmation) public virtual {
if (callerConfirmation != _msgSender()) {
revert AccessControlBadConfirmation();
}
​
_revokeRole(role, callerConfirmation);
}

Impact

Best practice not followed, admin can renounce role which will affect all access control functions in the contract.

Tools Used

Recommendations

Override the renounceRole() function and revert() it.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.