Rock Paper Scissors

Summary

The current admin is able to set a new admin without confirmation by utilizing RockPaperScissors::setAdmin(address _newAdmin)

Vulnerability Details

Accidental transfer of ownership is more likely to occur without a confirmation step e.g. the function could be accidentally called in a UI, or the provided address could be incorrect.

Impact

If an incorrect address is provided for the new admin, the RockPaperScissors contract is immediately and irrevocably owned by the provided address. This will lock the old admin out of functions like setAdmin and withdrawFees

Tools Used

Manual Review.

Recommendations

It is recommended to utilize the @openzeppelin/contracts/access/Ownable2Step.sol contract which requires the new admin to confirm transfer and allows for cancelling transfer. These extra steps greatly reduce the likelihood of an accidental transfer of ownership to an incorrect party.