Root + Impact

Description

• Normal behavior: OpenZeppelin Ownable (standard) sets the contract owner to msg.sender automatically in its no-arg constructor.

  
  

• Specific issue: The token constructor calls Ownable(msg.sender) in the inheritance list: contract BriTechToken is ERC20, Ownable {
  constructor() ERC20("BriTechLabs", "BTT") Ownable(msg.sender) {}
  ...
  }

  
  

  With the common OpenZeppelin Ownable (no-argument constructor), providing msg.sender is incorrect and will not compile against standard OpenZeppelin, or — if a custom Ownable variant exists — it may behave differently than intended. This can cause unexpected ownership initialization, deployment failures, or subtle ownership misconfiguration.

Risk

Likelihood:

• This occurs on every compile/deploy using the standard OpenZeppelin Ownable package (common setup), causing a compilation error or misbehavior.

It also occurs when developers port code between different Ownable variants or upgrade OpenZeppelin versions without updating the constructor invocation.

Impact:

• Deployment failure (compile-time) when using standard OpenZeppelin Ownable — prevents release.

Incorrect owner assignment if a nonstandard Ownable with a parameterized constructor is used unintentionally, leading to unexpected admin privileges.

• High operational risk because ownership controls minting — any mis-initialization can lock admin flows or accidentally grant ownership elsewhere.

  
  

  Proof of Concept

  Explanation:

  • Standard OpenZeppelin Ownable has a no-argument constructor that automatically sets the owner to msg.sender.

  • By passing msg.sender explicitly, the compiler throws a type error (Wrong argument count for constructor call) and the contract fails to compile.

  • If a custom Ownable version is used instead, the owner might be incorrectly assigned, potentially granting admin privileges to an unintended address.

  Impact: Deployment failure or misconfigured ownership, which directly affects token control and minting rights.

  
  

Recommended Mitigation

Fix: Remove the erroneous parameter and let Ownable set the owner to msg.sender automatically. Use the standard patterns.