Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

Admin cannot change the collector role

tenderflower730

Root + Impact

Description

  • Snow::changeCollector can only be called by the collector, the admin cannot do any emergency change to the collector role if the collector address are compromised

@> modifier onlyCollector() {
if (msg.sender != s_collector) {
revert S__NotAllowed();
}
_;
}
​
@> function changeCollector(address _newCollector) external onlyCollector {
if (_newCollector == address(0)) {
revert S__ZeroAddress();
}
​
s_collector = _newCollector;
​
emit NewCollector(_newCollector);
}

Risk

Likelihood:

Low: the possibility of this to happened is certainly low, as it only happened when the collector role get hacked

Impact:

High: all the fee of the protocol would be stolen

Recommended Mitigation

+ modifier onlyCollectorAndAdmin() {
- modifier onlyCollector() {
+ if (msg.sender != s_collector && msg.sender != owner) {
- if (msg.sender != s_collector) {
revert S__NotAllowed();
}
_;
}
​
+ function changeCollector(address _newCollector) external onlyCollectorAndAdmin {
- function changeCollector(address _newCollector) external onlyCollector {
if (_newCollector == address(0)) {
revert S__ZeroAddress();
}
​
s_collector = _newCollector;
​
emit NewCollector(_newCollector);
}

Giving permission of changing collector role to the owner, reducing loss even if the collector get hacked.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!