Project

Summary

The owpWallet (or PLATFORM_TREASURY) address in the MembershipFactory contract cannot be updated because there is no update function provided.

Vulnerability Details

The MembershipFactory variable is defined as follows:

Since owpWallet is neither a constant nor an immutable variable, it appears intended to support updates to the address if needed. Other variables in the contract have setter functions (setBaseURI, setCurrencyManager, updateMembershipImplementation) that allow updating their values, but owpWallet does not.

Impact

Without an update function, owpWallet cannot be changed if a new address is needed.

Tools Used

Manual analysis

Recommendations

Add a setOwpWallet function to allow updating the owpWallet address when needed.