Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Inability to Update owpWallet Address Risks Irrecoverable Fee Loss

justawanderkid

Description

The owpWallet address is intended to receive fees whenever a new member joins a DAO on the One World Project platform.

However, there is no function to update this wallet address inside the MembershipFactory.sol.

If the One World Project team loses access to this wallet, fees will continue to be sent to an inaccessible address, resulting in permanent fee loss.

Additionally, if the wallet is compromised, there will be no way to redirect the fees to a secure address. This oversight limits the project’s ability to manage fee distribution securely and adjust to security needs over time.

Impact

  1. If the One World Project loses access to the owpWallet, all future fees intended for the project will be irretrievable.

  2. If the owpWallet is compromised, the One World Project team will be unable to change the address, and fees will continue to be forwarded to the compromised wallet. This would force the team to withdraw fees from the wallet quickly before attackers can do so themselves, creating additional security and operational risks.

Recommended Mitigation

Implement a function in MembershipFactory.sol that allows DEFAULT_ADMIN_ROLE to set new owpWallet address.

contract MembershipFactory is AccessControl, NativeMetaTransaction {
​
+ function updateOWPWallet(address _newWalletAddress) external onlyRole(DEFAULT_ADMIN_ROLE) {
+ require(_newWalletAddress != address(0), "Invalid address");
+ owpWallet = _newWalletAddress;
+ }
​
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Appeal created

justawanderkid Submitter
about 1 year ago
0xbrivan2 Lead Judge
about 1 year ago
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!