The project README clearly states that one of the main actors for the protocol is an owner. However there is nothing in the TokenLaunchHook contract to implement an owner. This is compounded by the fact that one of the listed responsibilities for the owner, is can modify fee parameters via administrative functions. These administrative functions are not implemented in the contract, which is a separate issue, but even if they were there would not be a way to make them only callable by the owner.
Likelihood:
The missing owner role is a permanent condition from deployment - every deployment of this contract will lack administrative capabilities
Any token launch using this hook will be affected, as there is no way to implement ownership post-deployment
Impact:
This breaks the intended protocol design by not implementing one of the key specified roles, and stops their responsibilities being executed.
The TokenLaunchHook contract has no owner state variable, no Ownable inheritance, and no access control modifiers. This confirms that an owner role is not implemented.
Utilise the Ownable2Step abstract contract from Openzeppelin to make the TokenLaunchHook contract ownable, and set the contract deployer as the owner, as specified in the project README.
Note: The relevant Openzeppelin package can be installed by running forge install Openzeppelin/openzeppelin-contracts
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.
The contest is complete and the rewards are being distributed.