Submission Details
Impact:
Likelihood:
[L-1] Centralization Risk with using modifier `Ownable::onlyOwner` in `ContestManager` and `Pot`
[L-1] Centralization Risk with using modifier Ownable::onlyOwner in ContestManager and Pot
Description
There is a risk of centralization with the inheritance of Ownable and the use of the modifier onlyOwner.
In src/ContestManager.sol:
@> contract ContestManager is Ownable
...
function createContest(address[] memory players, uint256[] memory rewards, IERC20 token, uint256 totalRewards)
public
@> onlyOwner
returns (address)
...
@> function fundContest(uint256 index) public onlyOwner
...
@> function closeContest(address contest) public onlyOwner
In src/Pot.sol:
@> contract Pot is Ownable(msg.sender)
...
@> function closePot() external onlyOwner
Risk
Likelihood: There is always a risk that the owner of ContestManager or Pot uses the contracts maliciously.
Impact:
The impact is that if the owner were malicious, they can make function calls to sway the protocol to their advantage.
Proof of Concept
Recommended Mitigation
Verify that the owner is not malicious.
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.