The LikeRegistry
contract implements OpenZeppelin's Ownable
contract and also holds ETH funds. The inadvertent ownership transfer could therefore result in the funds being locked in the contract.
The Ownable
contract exposes a transferOwnership
function, which allows the current owner to transfer ownership to another address in a single function call. If the new owner is a contract, which doesn't implement the required logic, or is an invalid address, then the funds in the contract would be permanently locked.
High impact - the funds would be locked in the contract. Medium likelihood - the owner would have to make a mistake in the address they are transferring ownership to.
Manual review
Implement a 2-step ownership transfer mechanism, for example:
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.