Vyper Vested Claims

First Flight #34
Beginner FriendlyDeFi
100 EXP
View results
Submission Details
Severity: low
Invalid

Lack of Ownership Transfer Functionality

Description: The contract doesn't provide any mechanism to transfer ownership, which could be problematic if the owner's private key is compromised or if ownership needs to be transferred to a different entity.
The contract sets the owner at deployment but lacks functionality to update it:

@deploy
def __init__(merkle_root: bytes32, token: address, vesting_start_time: uint256, vesting_end_time: uint256):
# ...
self.owner = msg.sender
# ...

Impact: If the owner's private key is lost or compromised, there's no way to update the contract's administrative controls, potentially leaving the contract in a state where emergency functions like rescue_tokens cannot be called.

Recommended Mitigation: Implement a secure ownership transfer mechanism as described in the previous vulnerability.

Updates

Appeal created

bube Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.