Owner Privileges
Summary
The contract allows the owner to perform critical operations, such as updating the Merkle root and rescuing tokens. If the owner's private key is compromised, an attacker could potentially modify the Merkle root or withdraw tokens, which could lead to a loss of funds.
Vulnerability Details
Impact
Tools Used
Recommendations
Implement multi-signature wallets or timelocks for owner-sensitive operations, such as setting the Merkle root or rescuing tokens.
Ensure the private key of the owner account is stored securely, using hardware wallets or other secure means.
Appeal created
[Invalid] Owner can call rescue_tokens and withdraw users tokens
The `owner` is trusted and the function `rescue_tokens` can be called only by the owner and only in case of emergency. This means the owner will not act maliciously and will not call the function without need. Also, issues realated to the malicious admin actions are invalid according to the CodeHawks documentation: https://support.cyfrin.io/en/articles/10059196-findings-validity
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.