Core Contracts

Summary

Use Ownable2Step instead of ownable

Vulnerability Details

This isn't techinically a vulnerability but however, the commonly used Openzeppelin ownable implementation has a shortcoming that it allows the owner to transfer ownership to a non-existent or mistyped address.

Ownable2Step is safer than Ownable for smart contracts because the owner cannot accidentally transfer smart contract ownership to a mistyped address. Rather than directly transferring to the new owner, the transfer only completes when the new owner accepts ownership.

Impact

Transferring ownership to a non-existent or mistyped address

Tools Used

Manual Review

Recommendations

Use ownable2step. Refer to Rareskills: Openzeppelin Ownable: Use Ownable2Step Instead