Submission Details
Severity:
Uninitialized storage variable
Summary
in the /src/module/Trustee.sol contract, the address trustee` variable isn't set to the "msg.sender"
Vulnerability Details
```
abstract contract Trustee {
error NotTrustee(address);
* address trustee;
address assetToPay;
mapping(uint256 NftIndex => uint256 value) nftValue;
modifier onlyTrustee() {
if (msg.sender != trustee) {
revert NotTrustee(msg.sender);
}
_;
}
Impact
High severity because the attacker can make himself the owner of the contract and become the trustee himself
Tools Used
manual review
Recommendations
abstract contract Trustee {
error NotTrustee(address);
address trustee;
address assetToPay;
+ trustee = msg.sender;
mapping(uint256 NftIndex => uint256 value) nftValue;
modifier onlyTrustee() {
if (msg.sender != trustee) {
revert NotTrustee(msg.sender);
}
_;
}
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.