Submission Details
Severity:
`InheritanceManager:appointTrustee` is missing an operator
Summary
InheritanceManager:appointTrustee is a public function without any modifiers
Vulnerability Details
Since appointTrustee can be called by anyone, an unfair beneficiary can set the trustee for themselves and change the values of NFTs or change the asset to a custom token
Impact
This can lead to malicious appropriation of assets, allowing the attacker to hold them for free
Recommendations
Limit the function to onlyOwner calls
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.